Those comments are not taking sides or minimizing the impact of what's happening. They're just mixing a bit of project management-jargon with real life events.
Just doing apt-get update && apt-get upgrade && apt-get dist-upgrade should be enough. You have to be careful, do backups and all that, but that's basically all you need to do.
The problem is not CookieStore itself but the fact that you need to know the caveats if you expect to use it properly. That alone makes it a bad default setting for a framework that favors convention over configuration.