I concur.
In addition to avoiding breaking changes, when they seem unavoidable, we try as hard as possible to create a “nice” migration path for existing callers (an example by yours truly). As Severin points out, particularly in the case of vulnerabilities, providing a nice migration path isn’t always feasible.
The Governance team within DFINITY is the main developer of CMC, Governance, and Root canisters. I would say @lara is a good person to tag for those.
For Ledger, consider contacting @mathiasb .