I guess it just lead to a turning point, where end-users won't have to worry about security updates for x or y library, but more about updating the application they're using. In the case you use containers/micro-vms, if there is a security update to do, the container "maintainer" would be in charge to push the security update, then you just need to update your container.

I'm not sure which one is the most constraining, dealing with conflicts or being careful on relating on well maintained "containers".

I guess, for production environments, the second option looks like a wise choice.