(a) Not all vendors are the same, (b) Not all situations are the same, (c) Open source isn't exactly world renowned for porting back fixes to older releases.
I used to work for a MAJOR MAJOR Oracle customer and they would not back port y2k fixes to relatively recent oracle products ie the version before.
This caused a lot of BT employes a lot of pain you had to get a very senior manager to sign off on missing your y2k deadline which was the year before y2k - and you probably got dinged on your apr for it
