In the past I've worked for hosts small and large. They didn't upgrade anything, unless an OS upgrade occurred. A lot of 'low cost' hosts are like this, sadly. While 5.16.3 may have a backport for CVE-2013-1667, I doubt it caters for all the others.