> Reality is a lot simpler - it wasn't deemed worth the cost of addressing the security problems in the existing library so someone chose to abandon the format.

As evidenced by what? When first rejecting JPEG XL, Google did share their reasoning, but security problems hardly figured in it.