I get what you're saying about staying on an old version, but, and we can split hairs here, preventing downgrade is in effect a forced upgrade.

Ideally, there should be a system where security patches are installed, but anythingv what is optional and reversible