I agree for projects I maintain, where I can bump a package and the dependencies myself. But on a server with 10 services, depending on 10 versions of a badly

I agree for projects I maintain, where I can bump a package and the dependencies myself. But on a server with 10 services, depending on 10 versions of a badly maintained project that requires an urgent security patch? Not so much, I rather just update a shared lib. It's a matter of scale and resources. The great thing is that there are options, Flatpaks do what you want, no need to demand that Debian does the same.