It runs on or depends on so many disparate software packages that each comes with their own versioning strategy, security model, etc.

Usually when you install a package in a linux distro either the distro or the package maintainer of the package you install is responsible to ensure it keeps working (with varying levels of effort depending on distro, support strategy, etc...).

With these sort of amalgamation packages that becomes weird. Nobody is responsible and its built with many parts that never tested new versions in that configuration.

You need to either understand what you run or understand who you delegated that understanding to.

This is true for individual packages and even more for amalgamations like this.

In most of these amalgamations you delegated it to nobody and you don't realize until it breaks and you cannot fix it.