May I ask a stupid question?

I have developed a product which uses MbedTLS 2.16. I am on this
mailing list so I get to see the various updates since.

And I wonder: is there any point in upgrading?

If your embedded product is a client, and usually behind NAT (or an
equivalent firewall) and accessing some private server (or a trusted
public server) on a schedule of its own choosing, then the whole
attack surface is minimal.

(…)

Basically, as you can see, I see the only valid applications for
MbedTLS in scenarios where a) the box is a client and b) you control
the other end's server (or, if you don't control it, you are prepared
to periodically revisit your code and fix it whenever the server's
owner has changed the crypto suite or whatever).

ISTM that the general drift in the IoT sphere is indeed along the
lines I describe. It "incidentally" also delivers a revenue stream
because you can charge the customer for that server ;) Whereas if you
just sell a box, you have no business model for funding long term
functionality.