I have to admit, I’ve never touched the kind of issue where I need to load a bunch of binaries I can’t automatically trust as part of a build process, so I won’t speak on that.
On the part about OS updates being a PITA, yes: I’ll admit that I offset updating the macOS major version for as long as possible. As long as my major version is maintained/get’s security updates, and the newer versions are backwards compatible enough that I can compile stuff for them without any hassle, I’ll stay on macOS 13. Judging by historical data, that means I have about two more years before I might need to spend an hour or two fixing up stuff that bugs out with the eventual major update.