Security vulnerabilities get too much credit. It's "think of the children" of the software world. Most updates don't fix any, most vulnerabilities won't get used in the real world against you either, and in many cases the security is for the corporation against the customer instead.

'Security and bug fixes' is what companies say when they want you to update. They might be correct. You see that on Google Play store a lot ... Really they should mandate availability of descriptive and accurate update notes. But then Google are one of the worst offenders, often their updates don't even include details at all. One has to go spelunking through comments and forums trying to find if the update actually fixes anything or if it's just to include a few more ads or tracking mechanics.

Hooray for OSS, F-Droid is way better ime.