That's great until an attacker compromises the automatic update system and uses it as a vector.

but the embargo delayed the updates

This is how you get wrecked by malicious packages being published or other breaking bugs. Pin your versions.