[perlgeek]

If somebody discovers a security bug, what are the chances that somebody can cut a high-quality release with the fix in it, if it hasn't been done for two years?

[FartyMcFarter]

The fix can be submitted on the previous release branch. If that branch doesn't exist, it can be cut off of the old commit the release was made from.

If your objective is to improve security, this is better than getting a version with myriad changes that may introduce new bugs.