I understand that no piece of software is ever finished but I think OpenSSH serves its purpose very well and isn't the kind of software that is worth adding experimental features that would change its scope/purpose and therefore releases tend towards bug fixes and security patches and in this sense makes it kind of "finished" as much as I hate saying it like that. An important aspect of unix philosophy is one tool does one job very well.

   * sshd(8): fix circumvention of MaxAuthTries using keyboard-
     interactive authentication. By specifying a long, repeating
     keyboard-interactive "devices" string, an attacker could request
     the same authentication method be tried thousands of times in
     a single pass. The LoginGraceTime timeout in sshd(8) and any
     authentication failure delays implemented by the authentication
     mechanism itself were still applied. Found by Kingcope.

That's a pretty big hole. See also: http://seclists.org/fulldisclosure/2015/Jul/92

* Support for the 1024-bit diffie-hellman-group1-sha1 key exchange is disabled by default at run-time. It may be re-enabled using the instructions at http://www.openssh.com/legacy.html

* Support for ssh-dss, ssh-dss-cert-* host and user keys is disabled by default at run-time. These may be re-enabled using the instructions at http://www.openssh.com/legacy.html

You're probably missing that SSH just increments the version number. Ticking over to a new whole number is meaningless from their point of view IIRC.