My point is less that leaving Arch alone breaks things and more that updating after a really long time can break something. It also kinda defeats the point of using a rolling release distro. I can see how you thought i was spreading misinformation though. My bad for poor wording.
Just because not many people use a package, doesn’t mean it is irrelevant. For open source packages (or anything really), as soon as one additional person uses a package, that package becomes relevant. The person/people using it become its advertisers, and when enough people are seen using a product, especially a free one, a larger group will use either that package or something similar to cut their own programming costs.
This is simplified, but the point is that we need to stop this sort of thing at the root (the package itself) before it gets noticed by larger groups and companies who might actually get away with this BS. Always remember, we are tech/privacy nerds. We are the minority, and the average person doesn’t care until something hurts them directly.