The article claims that since security fixes land in latest releases first but must be individually backported to older releases, therefore staying on an older

The article claims that since security fixes land in latest releases first but must be individually backported to older releases, therefore staying on an older release is less secure. However I think this is in itself a false premise. The obvious counterargument is that it is newer releases in which new security vulnerabilities are introduced, so after a while, an older release with backported security fixes is more secure. Which argument is true depends on the relative rates of fixes vs. vulnerability introductions. This will differ per project, and therefore the balance may tip both ways too, depending. But the article fails to make any assessment of this at all.