Because you really don't care about getting fixes for security vulnerabilities? Or you have your own infosec team that tracks every single fix in Rails3 and bac

Because you really don't care about getting fixes for security vulnerabilities? Or you have your own infosec team that tracks every single fix in Rails3 and backports it?