> There is exactly one consistent developer on the project

This is a problem by itself and I wonder if there is some possibility to address this maybe by trying to improve planning, outlining the "what to do" and "future goals" and somehow improving delegation of tasks?

On the security updates.
As for what I can see/understand from here we had only two mayor incidents in the past (2020.07 and 2023.12). In the first place I guess there is some kind of incubation time where the fix is published and the update by the majority of instances is done. Once that quarantine time is over I can't see any reason to address the issue more into deep and educate the community on what is/was the problem itself, which versions and use cases are are affected and if there are perhaps fixes without updating everything by just pull/update certain modified files. I actually tried to reach out the last time (2023.12) asking for information more into deep about the problem to see if I could fix the problem on a 2023.05 version, even linking to the fixed files on github I could find concerning apparently the issue.
I didn't get an answer at all.
And not getting an answer at all is the worst thing that can happen in communication. A "no chance to fix this in 2023.05" or "this security issue only can happen within your node, only a profile of your node can compromise another profile of your node" would have helped me out or at least clarified my doubts.
Instead I just stud there in the middle of the fog of not knowing.

What I mend by LTS was simply to say that I guess that there should be some friendica versions that where quite sound and complete as they were and that it should be possible, sooner or later, at least from now on, to look and say:
"Ok this is like a completed and polished evolutionary step in friendica" and mark it as such before moving on with some mayor changes in the DB or whatever, and when a real security issue comes up, to take a minute, look back and say "this most likely affects versions till XYZ", "this is maybe solvable by modifying the files X and Y of the pull request Z" and perhaps make some notes about where or why this might create trouble if someone tries to fix this in earlier versions.
_____

Thx @Michael Vogel for the hint about automated updates but the last thing I will do is to put some automatic update routine into my setup. I sat once in front of a blank page after an update and and when I started to read the help instructions, pointing me to my mysql DB and asking for queries and what not, the abyss of helplessness opened in front of me and my intention to just be able to live some basic freedoms of privacy and ownership of my own data in a common social web simply went down the drain with tons of posts, interactions and social contacts created with dedication from the loneliness of my reality. I don't want to become a coder nor a web developer I just want a work station that works as is, create content and have some communication.

I prefer to run this version as it is into the ground till the day it get's compromised, hacked or destroyed by time and space living meanwhile, instead of not knowing if the server shows up or not every time I open my browser, perhaps having to struggle with some code for days just to make it work again or maybe not ..