As always, the easiest way to manage this is to have as few dependencies as possible. If you have a lockfile with thousands of entries, you won't be able to go through them and decide which upgrades are legitimate urgent security updates and which can wait. If you have 10? You'll manage.
Security fixes for actively exploited vulnerabilities demand an emergency response. The risk of introducing new, unknown flaws is less than risk of having an active known exploited vulnerability.
However, absent the risk of a KEV, that changes the equation. Now the risks of code changes causing breaking changes plus the risk of supply chain attacks is greater than the risk of having to put some thought and time in to manage your software library versions.
It's not like AI created this distinction, either. Neither did CI/CD. This is standard systems administration -- literally ISO/IEC 20000 ITSM. It's exactly why, traditionally, new features are often limited to major versions. It's why binary compatibility was a huge issue with RHES 20 years ago, and why distros pin versions and backport security and selective bug fixes. A developer that doesn't know this is telling on themselves why they shouldn't have write access to production. Stability matters a lot because we like to get paychecks.