I could've been more clear in my original post. I'm not just thinking about "getting an app running": ruby, rbenv, and bundler has had that solved for many year

I could've been more clear in my original post. I'm not just thinking about "getting an app running": ruby, rbenv, and bundler has had that solved for many years, and npm, nvm (or whatever and js is stable there as well. If you take any app built three years ago, you are going to have critical security vulns in libraries you depend on. With java think of the log4j fiasco. With Ruby there are nokogiri or rails things. With javascript there are probably at least a handful of downstream packages that have pretty big security issues. Now you have to update dependencies, and then the real fun begins. If it a walled-off intranet app on a VPN, or a small CLI app, sure, maybe you can ignore that issue. But if its a public web or mobile app that is gonna see real use, you are going to have to head down the security audit + package update rabbit-hole.