"To suggest that any one user type is the 'most important' serves to help illustrate the challenge of treating content management as one to be solved by a single application"

I think that you are taking Thomas' article too literally. No one is suggesting that we ignore the final audience. But I think we can all agree that content is king. By giving more attention to your content creators they can spend more time crafting the content rather than fighting the interface and fighting the workflow that doesn't mirror internal processes.

"Nowhere does this growing complexity result in more pain than with the never-ending and expensive two- to three-year cycle of upgrading a website to a new version of its underlying CMS platform."

While things are unique for every site and every dev shop, rarely do we encounter this situation. Our clients are looking to completely revamp their sites every ~3 years to freshen the design, re-brand, and update the IA to better reflect their evolving organization. Ideally these sorts of things would happen ongoing, but most of the organizations that we work with don't have the internal bandwidth to be constantly iterating.

For those sites that do hit the security deadline before they want a total site refresh, upgrading to the newest version is probably not what they need. Keep in mind that:
- Most security announcements won't apply to this site.
- Most of those that do are only exploitable by trusted users.
- Those that remain will be _far_ cheaper to fix on an individual basis than the 20k-30k to completely upgrade.