Can anyone help settle what I thought was a simple question.
A fellow DBA friend and I were talking about compatibility levels in general, and their relation to security specifically. He posited that a good reason to bring them as current as possible was to reduce security vulnerabilities caused by them. I countered that formerly SPs and currently CUs and hotfixes would surely patch those vulnerabilities, i.e. running a database in 2005 compatibility mode in a 2014 SQL Server instance surely does not revert that database back to 2005 SP4 security levels/vulnerabilities.
I've been searching for documentation to back this claim up but I've been unable to find any. Does anyone know of any authoritative documentation that would show me either correct or in error?