The cost of maintenance is very high in the Python/Django stack those days!
It seems that there are very few breaking changes in Django 3 that will be relevant for application developers. Third-party packages poking around in Django's internals might have a slightly harder time, but it still seems very managable.
True, but the community has done a great job managing this over a long period of time. It's most costly if you haven't been investing along the way.
Code is alive and needs maintenance. Period. You cannot expect simultaneously a modern framework with eternal backwards compatibility and security gaps.