What's the security problem with Compatibility Mode? Is it just that it lets you let an app run with more permissions than it otherwise has on the new APIs? Or does it turn off a bunch of mitigations?
The Android permissions churn seems meant to protect people from applications: previously you could just say you need GPS, install, and then use GPS all the time. But untrustworthy apps started tracking people all the time, so Google declared that now only Google Maps is allowed to track people all the time, and that everybody else has to do a new location access ritual. If I have an old app that I trust (or wrote!) but doesn't do the ritual, I ought to be able to convey to the OS that I trust the application anyway. The machine works for me, not for Google's idea of what my privacy preferences are.
I don't see how a developer not implementing new permissions models is the developer not caring about security. I guess a more robustly sandboxed app is more secure than a less robustly sandboxed app? But just because a security enhancement like that is available doesn't mean it's actually worth doing, and the user experience of the new system (get sent to settings to toggle on file system access for a file manager) is often worse than before.
Having new development is better for the user than not; they will get features and improvements. But having to do development to prevent the user from losing features over time is a pure cost to the developer. The rate at which it currently happens makes it unnecessary hard to do projects that aren't shaped like commercial subscription services.