I think the views espoused in this article are not the best way to handle such situations. Bob should have pinned the dependency to the older version being used

I think the views espoused in this article are not the best way to handle such situations. Bob should have pinned the dependency to the older version being used (assuming that can be done in homebrew) so that his companies usage of it can continue uninterrupted. However his team should also be able to properly identify and schedule the work needed to update the dependency. Having something just randomly break one day in production is not acceptable. If homebrew packages can't be pinned to an older version then that would be a technical difficency of homebrew itself.