Ugh I hate these arguments about giving bad actors easier access. Bad actors are going to figure out flaws and security holes whether it’s open source or not. Security through obfuscation is a temporary measure and having more eyes on the source means more chances for good actors to find flaws and publicize them for fixes.

For versioning I always viewed the numbers as independent from each other, just like with ip addresses.

I really like X.Y.Z

X is for major overhauls. Y is for a new individual feature added or dramatically reworked, Z is for bug fixes, updates and polish.

Like Blender is currently on 3.6. They had a dramatic major program wide overhaul a few years ago. And since then have been adding new features and reworking old ones in major 3.X releases, and occasionally have smaller updates and fixes in between, giving us 3.X.Y updates.