The problem is, it's not unusual that software vendors (e.g. Red Hat provides security patches to older version of software, so it looks like the version is 1.5.5, but the security issues are being backported. Therefore, ideally, the version constraints should be there only in cases it requires the functionality that was not before.