Am I right when I assume that it's usually insecure to specify maximum (or exact) versions of a library in project's requirements?
If the requirement is due to a possible API change in later versions then this requirement makes sense. You will often find that Java applications require a specific version of Java since there are lots of small changes between the Java version which might (not necessarily will) break the application. Sometimes the requirement only says with which software stack it was tested and that no support will be given if used with another software stack.
It is bad and insecure if this requirement means that you cannot upgrade the software stack in case of vulnerabilities.
... most Linux package managers that basically "force" developers to port their software to new versions of libraries.
Not really. Most Linux distributions do not enforce the newest library in case of vulnerabilities with the older version, but instead try to port the bug fixes back to the older version. Only when a new distributions gets released they include newer versions of the software stack, but also often include additionally older versions to give existing software the (older) libraries they need.
At the end each developer has only limited time to test and thus testing is done only with a few variations of the software stack. And most developers don't have the time to adapt and test their software with each new version of a library or programming language etc.