This doesn't change the fact that some security fixes forces behavioral changes, and semver doesn't protect you against that. You fix the bug, and the behavior

This doesn't change the fact that some security fixes forces behavioral changes, and semver doesn't protect you against that. You fix the bug, and the behavior changes, because your design was wrong in the first place. Now there is at least one library which depends on that behavior so bad, so they can't change their dependency chain in two days.