It is a mantra that web browser teams heed. That's why the HTML living standard is the absolute mess it is.
"We don't break userspace" is not an absolute rule, and has plenty of exceptions in practice, including security and things where no legitimate use case has been identified.
Interestingly enough, the kernel has broken my (userspace) programs at two different occasions. Both times were knowing and intentional, as in the commit messages acknowledged that they were making breaking changes, and they weren't because of security either.
But these were only two occasions over ~10 years, so it's not too big of a deal.
I understand where the phrase is from. I am saying the rule is not as absolute as you think it is. Linus himself breaks userspace on occasion where it is warranted.