What is a 'versioned API compatibility matrix' in the context of mobile app distribution, and why do outdated app versions represent a security risk?

• A.Outdated versions may matter for the backend alone, and the client code is irrelevant to an attacker who has to reach the server first: a team may leave old builds in the field, and the distribution channel is typically judged on reach rather than on patch velocity for a consumer title
• B.Mobile apps may contain security vulnerabilities patched in later versions; users who do not update continue running vulnerable code. Both Google Play and App Store allow developers to force minimum version requirements, and enterprise MDM can block apps below a minimum build number
• C.Outdated apps may run slower on modern hardware, and the security posture is typically unchanged while the operating system stays patched: a team should prioritize a rewrite for performance, and the distribution controls that force an update are usually reserved for a broken release in the field