tldr; the main purpose of this post is actually to document that I discovered a Permissions Escalation in the code for thread conversion. But I thought you also deserved some sort of acknowledgment to your previous reply...
Normally I would agree with you on the timing, but in this case there were 2 bug reports between June and September, making it very difficult to justify packaging a release in the first 3 months of the 6-month period in question (really, 5 months so far). Starting in September, we began to see some changes that could start to justify packaging a release (remember we're limited in the types of changes that we're allowed to put in certain releases), and around late September/early October we got to a point where we began considering packaging a release (in fact I see that the upgrade script started to be written on 9/27). So it has been on our todo list, and we are building toward it.
We basically do make a freeze on things to be fixed at a certain point, although I see that when that happens is not described in the release policy. It's somewhat based on achieving the earlier points in the release policy, the part about 10 resolved issues and 60 days since the last release, although there are other factors.
So at this point we basically say, that we're now focused on building the release, and we're only going to include new reports in the next release if they are critical or extremely easy/short to fix. I guess a problem is, that even after that point, all newly discovered issues still have to be triaged to determine the level of severity, before it can be said, yeah that can wait for a future release.
For example, perhaps this bug report may not necessarily fall under the "critical" description, because it otherwise relates to a minor, rarely used feature. But it was triaged to determine why the option was not appearing (first thought was a "permissions de-escalation", which is considered critical). In the process of determining this, I discovered that the thread conversion process, which actually works against other versions of forum software, does contain a "permissions escalation"... and that triggers a future security patch.
I do take your point that some elements of this could possibly be streamlined more, and perhaps we did kind of drag our feet on this upcoming release. But hopefully, it will be worth the wait.