A malicious person could have many XRPL nodes running and make it appear that the entire network is behind on node updates.

It is not likely that one should simply look at the percentage of nodes in the entire network.