It doesn't upgrade everything. It upgrades dependencies and dependents of those dependencies (which, admittedly, can feel like everything). It does this because the alternative is sometimes breaking things.
A "breaking things without this example":
- you want to install something that depends on `readline`
- the binary package for the thing you want requires the latest `readline`
- this upgrades `readline` on installation
Now, we have a choice. Either we upgrade _everything_ that depends on `readline` that you have installed or we knowingly break some of the things you have installed that depend on `readline`. We choose the safer option by default.
If you leave it a long time between updating: you are more likely to have more dependencies updated which requires more dependents to be updated.
