The open source Photon OS has nothing to do with the commercial version of products. It may be a strict explanation but it helps to understand the difference between a newer build of a rpm package to pre-hardened appliances. There is no support for 3rd party modifications on VCSA as mentioned in https://kb.vmware.com/s/article/80767.
The Photon OS major release reflects the Linux kernel version as it is tuned for performance when Photon OS runs on vSphere. 1.0 is pinned to Linux kernel 4.4, 2.0 to 4.9, 3.0 to 4.19 and 4.0 to 5.10. All the kernels are LTS, but with different EOL.
4.4 February 2022
4.9 January 2023
4.19 December 2024
5.10 December 2022
Comparing those dates with the general support period of a VCSA release clearly shows that we can expect patches for all kernel versions and optimized on vSphere.
The method of signaling patches available and periodically download package upgrades and apply them has had a journey. In 6.7 the time drift between already publicly published rpm package updates and available as VCSA security updates (here) made quite a few customers think that they must/can "increase security manually" by patching the underlying OS installation. For most customers the first version of signaling patches was an overkill. With VCSA 7.0 or higher the smart signaling in vSphere Client is a big plus.
Planning a vSphere upgrade includes aligning the necessary steps for VCSA without to care about VCSA inner components.
