The thing is: The standard itself is rather well designed and didn’t need too much updates (they just extended the possible packet contents in terms of possible parameters - which technically isn’t that necessary as you can fall back to ASCI).

The last major updates were more towards extending functions (KNX over RF), connecting locations via IP tunnel, and securing the packets themselves (which is not really necessary for single household installations but VERY much for multi tennant installations).

The major strength of KNX is the bus packet system itself - as the packets are standardized there are only a few attack avenues. An attacker could flood the bus with packets, try to update with fraudulent code (if none did put a password on it) or try to put fraudulent content in a module that accepts ASCI packets. The problem is the access - the attacker would need physical access or the IP gateway (if existing)would need to be unsecured towards the internet… In the end it is a fairly resilient piece of software.