You make this sound like it is unique to java. I remember heartbleed had similar, in that the lts I was on did not have the vulnerable library.

At some level, as long as releases add functionality, the basic rules of systemantics will guarantee unintended interactions.