There are endless examples of libraries being updated, due to bad code in the library. It's not a rare event, it's very, very common. If a library is abandone

There are endless examples of libraries being updated, due to bad code in the library. It's not a rare event, it's very, very common. If a library is abandoned, and no one is around updating the code for vulnerabilities, it's trouble. That's because one day you can use it, and the next you cannot. (Yes you can personally patch it, but that's an issue that's come up. And how will you know? Look at all the bugtrackers daily to see people yelling "HEY!"?)