By "discovered vulnerabilities", I mean a security issue that wasn't known when the library was first written but then came to be known. This is what's fixed when a library is maintained.

This entirely depends on the library, but I just generally don't see a lot of security fixes in library updates. But for compiler updates, I do.

I'm speaking super broadly, and this will be very different for a Python graphing library versus a C networking library.