Well, even SDCC has approximately only one release per year. And I guess commercial software also has many fixes quite some time before the next release. But the difference is that you can't get them. And you also have to pay for the new release even if you were the one that pointed the problem out to them and thus helping them to improve their product.

Most commercial software vendors also do not have a public bug tracker. So you can't find out if your bug was already reported or fixed in an intermediate version (what SDCC calls daily snapshots) that will eventually become the next release.

Even SDCC has some very long standing bugs as anyone can see in the bug tracker. And sometimes our daily snapshots fail to pass regression tests, so not every revision is valid. And even if it did pass it still might have introduced new bugs. A release version gets to see a little bit more testing.

The difference is being "open" about almost everything.