As stated on this website http://fluidai.co/examples/ one of Solidity's vulnerabilities is using an open version in pragma:
pragma solidity ^0.4.11;
You're telling the Solidity compiler to use the latest version of solidity bigger than 0.4.11. This is a problem because you're writing code with the way of doing things in an older version. Newer versions of Solidity deprecate functions like
throw;and break your program if you're using them.
Is it really a problem?
The caret constraint in the example will be satisfied by any version matching >=0.4.11 and <0.5.0 http://jubianchi.github.io/semver-check/. Only bug fixes will be introduced in newer versions with this constraint.
Any breaking changes such as deprecating throw will necessitate the minor or major version bump. Using the caret is thus safe.
I don't think its a problem as you mentioned, but its a best practice to lock the compiler version to the one used to test your contract to avoid any kind of issue that might be introduced in the new versions. Lets say a new compiler version introduce a vulnerability, that might affect your contract as well. Unless you're developing a contract that will be consumed by other developers, its recommended to lock the compiler version as specified in the consensys best practices.
Contracts should be deployed with the same compiler version and flags that they have been tested the most with. Locking the pragma helps ensure that contracts do not accidentally get deployed using, for example, the latest compiler which may have higher risks of undiscovered bugs. Contracts may also be deployed by others and the pragma indicates the compiler version intended by the original authors.
other security tools can help also discover vulnerabilities during the development
