But there are all kinds of code-level changes that end up being necessary, even if you never want any new features. You can't just have sysadmins and expect to run a service over the Internet.
What kinds of changes? Operating systems are also feature-complete and don't need that yearly release cycle. They only need updating if there are new hardware capabilities that need to be exposed to applications. And security patches don't change APIs.
