I think security updates are mostly BS designed to make users voluntarily give up control. Almost nobody would ever be affected by these CVEs but the ceding of control affects everyone.