composer and Lightning
Looks like you've largely answered your own question. But to confirm, Lightning generally does not pin to a specific version of core in it's composer.json file. The current constraint is ~8.3.1 (note the tilde) which means the current release of Lightning should work with core 8.3.1 to 8.3.9(repeating) but not 8.4.0.

Core is the exception to the rule. Lightning normally pins to specific versions of dependencies if they are patched (see Lightning's dependency constraint logic). But since core follows SemVer, has predictable releases, and Lightning releases every time core does, Lightning doesn't pin core - even when it is patched (which is pretty much always).

Lightning increments the second digit of its release numbers (the minor release) when Drupal makes a minor release. In the current release of Lightning (2.1.4) the one relates to the three in the current release of core (8.3.3). So Lightning 2.1.x should run on any core 8.3.x. That's why Lightning uses the tilde (~) modifier and three digits when specifying Drupal core constraints.