Security flaws mean nothing to the application I use Ansible for, but stability does. Control servers are in private networks, and they configure equipment guarded by murderous thugs, so no problem there.
The control servers don't get updated that often, but when they do, it's not good if things stop working, because, you know, the equipment they configure is owned by people who employ murderous thugs to guard it. Kind of a problem.
We originally looked at Ansible and thought, OK, Red Hat, nothing more stable than that. Ansible, flagship product. It seemed like a good bet, but turned out not to be, that Red Hat wasn't likely to deprecate a major version of a software package during the lifetime of one of its operating systems, in this case EL6. Given how much of a moving target Ansible has turned out to be, I definitely should have subscribed to epel-announce, to, you know, minimize the chance of getting murdered, but here we are.
Anyhow, thanks for the feedback.