To clarify your second point -- you can maintain security fixes for 10 years without having to worry about random changes that may break your installed apps and workflows.
Which it did, quite often. There would often be bugs that existed between kernel 2.6.300 and 2.6.336 or some nonsense. The idea is nice, but in practice all of that backporting just seemed like a lot of work for not much benefit.
1. Big "enterprise" software would run on it because it was basically RedHat.
2. It had an exceptionally long support cycle, so you could setup a machine and ignore it for ten years.