How many applications will delay getting those security patches because they assume that 8.x is a breaking change?

There's probably a fair number of setups that more-or-less automatically upgrade to the next minor version, but not the next major.