My trust in you is broken.

And most of BTCpay users don't even care or update...

Honest, and the cause is structural. Without version reporting a maintainer has no idea who still runs an old release, so reaching those users is guesswork. An instance behind a reverse proxy with a stale image looks healthy from outside, and nobody goes looking until something breaks. A dashboard notice only reaches the person who logs in that week. Better to close the gap with a scheduled check: something that compares the running version against the latest release and shouts when it drifts. Plugins deserve the same treatment. Each one ships on its own schedule, and the ones nobody watches are the ones that get left behind.

There is a receiving-side failure mode even when the project does reach out: the person who deployed the instance is not always the person running it, so the notice lands in a stale inbox, and a single email gets read once. What actually lands is routing the notice to the channel the operator already lives in, chat or SMS or push, not just the blog, and repeating the nudge for a few days. A critical patch for self-hosted software should page someone, not go out as a newsletter.