How are bugs "fixed in one place" that way?

You either accept updates of third party packages, with little to no vetting of your own, and get fixes "for free" or… you don't.

There's no middle ground: the only way to save effort is to trust others.