> This stability does mean that old React (or Knockout, or whatever) applications will still work just fine for the end users, likewise without a single line changed.

Not in the current enterprise cyberops environment of needing to pass dependency security scans at all times.