How exactly is the dependability and stability determined? By back-porting you are already changing the original version of software. What then becomes the diff

How exactly is the dependability and stability determined? By back-porting you are already changing the original version of software. What then becomes the difference at that point verse tracking the actual project version? Assuming both go through regular testing. It seems more straight forward to be able to look at a change log from the application, lets say httpd, then to go search for cherry picked back-porting changes. https://downloads.apache.org/httpd/CHANGES_2.4 https://downloads.apache.org/httpd/CHANGES_2.4 verse https://centos.pkgs.org/7/centos-updates-x86_64/httpd-2.4.6-99.el7.centos.1.x86_64.rpm.html https://centos.pkgs.org/7/centos-updates-x86_64/httpd-2.4.6-... I just picked httpd since its a common application and as far as I can tell all the updates are minor release numbers. If you have another example that would be useful to see for consideration as I'm genuinely curious which applications change so much that people are dependent upon back-porting for stability.