What does that solve, you already get a higher version if you create a new app or update?

This locks the minimum version so there shouldn't be a chance to install a lower version unless you manually modify it. Generally you're right and it should install a newer version.

But locking minimum version to non vulnerable versions are still a good practice and was usually done in Laravel too (see #5354). Also this only affects newly created projects so there is no backward compatibility issues.

For example you install my/package via composer which needs illuminate/support: 6.20.15 then composer will install that version of the framework even though there are newer version available. This way it wont install that package unless you manually allow it by lowering the version constraint.