> You can also argue that it is impossible to update dynamic libraries because they are used by multiple applications and you can't afford that any application breaks.

That's where maintenance branches comes in. You fix only the security issue, and push out a new version.