How often do packages get rebuilt? Is it only when there’s a new version?

Yes, only if there’s a new version.

The problem in that case would be that a package that is no longer developed (or has very long release cycles) would not receive the fix.

We specifically mark these kinds of packages as outdated (even deprecated) if they are older than 90 days

Currently, the stats:

This will improve if we can get more builders, currently we use the free CI provided by github actions