Im on 5.3.1 still, i can safely update to grab a VC title from eshop with out compromising vulnerabilities?
like said, there's no point staying in an old version as most hacks and "vulnerabilities" are now based on 5.5.1 only.
but to answer your question, yes you can stay on old 5.3.x and grab VC titles from eshop by using :
1) use DNS or proxy or router to block NUS urls
2) spoof to 5.5.1 (eshop sees 5.5.1 and don't ask to update at launch)
3) NNUPatcher (eshop sees "no new update" when calling the function to check better than just the spoofed "version.bin" file)
Now you are on shop, buy/download the game you want.
it will go to the download queue, but will probably NOT download because of the previous online check done by the console at launch: it detected it couldn't connect to nintendo's update servers, marking the connection as offline, so your download will NOT start until you reboot, then the queue will starts downloading before checking the update server.
4) Reboot to trigger the download and install
But again, it's more difficulties for no real reason. You can just update to 5.5.1 by temporarily disabling all your filters.
re-enable them after the successful update.