Provisioning an environment is easy these days with virtualization technologies running rampant. And figuring out what DBMS version you need to provision for a given back up is as simple as RESTORE HEADERONLY. 🙂
From my perspective, keeping ahead of the patch-cycle has more benefits than just security. It also prevents developers from hard-coding exploits of bugs into their procs/functions/SQL-CLR code.
YMMV