That's all quite simple to answer with a firm "depends".
1. Remember, it's all volunteer work (by companies and individuals).
2. Watch the release announcements and changelogs to learn about the
lifetimes of -stable lines (they vary due to circumstances) and
about what goes in into these lines. There are also some bits in
Documentation/stable_kernel_rules.txt.
Among else, it depends on volunteered manpower for patch verification
and even on sheer coincidence (somebody needs to be aware that an issue
is relevant to an active -stable line) whether a fix goes into -stable
or not.
Circumstances which lead to a -stable line remaining active for longer
than usual typically boil down to the motives of an individual developer
who picks up maintenance, like Adrian happened to do with 2.6.16.y and
plans to repeat with 2.6.27.y, or like Greg kept/ keeps 2.6.25.y active
alongside 2.6.26.y because it's directly useful to other work of his, AFAIU.
If you are interested in more structured release policies, you shouldn't
hesitate to have a look at vendor kernel lines.
--
Stefan Richter
-=====-==--- =-=- =-==-
http://arcgraph.de/sr/
--
