In reply to Jeff.

Not every security flaw is discovered or addressed but those that are only come through updates. Therefore, it's prudent to keep everything up to date. If a user doesn't, they're more likely to have insecure code on their server.