I like qemu's version scheme were the major version increases every year (since version 4.0). So x.1 the first release in a year and you can see from a quick glance how "old" a version is.
They wouldn't want users thinking they were still using a "2024" kernel in 2032, for example, when they have 10+ years of support to provide.
The backporting is very much hit and miss.
Apart for regulations mandating vulnerable (we can call them outdated if you prefer being coy) versions, the elephant in the room is obviously non mainlined drivers but I wouldn’t touch that with a ten feet pole anyway.