So, how many libyears were that xz dependency out of date?

Libyears are meaningless. A library either has known vulnerabilities or it doesn't. When it doesn't, old is often better than new one.