There's no policy against backporting bugfixes, it just doesn't always happen due to lack of developers. If upstream doesn't provide backported bugfixes, it req

There's no policy against backporting bugfixes, it just doesn't always happen due to lack of developers. If upstream doesn't provide backported bugfixes, it requires someone else to volunteer the time/resources to do it. For some packages, companies sponsor long-term maintenance branches, or particularly interested volunteers take it upon themselves to do it. For other packages, nobody steps up to do the work, so it doesn't happen. I've found BSD ports pretty similar (mainly pkgsrc is the one I use). Some are very actively maintained, and others are much less actively maintained. Resources are limited, so pkgsrc maintenance happens only to the extent that someone makes it happen.