Imagine a development environment where you can't use CI, you need to do code archaeology for an unknown number of revisions. Patches, repros, tests, announcements, must all be done in secret. Then, if you did it right, the absolute best outcome you can hope for is that everyone upgrades and they notice no changes. It's extremely high risk (no CI, done in secret), low reward (nobody is stoked they have to upgrade bc security)