Great plans but not always the easiest to do.
It would be better if there was only one major release in a year. Some people have problems with updates and installs. I am still using FC1 as I need to remain productive. Some applications are not included in FC3 and some are updated in such a way that they won't work as they do in FC1 (GIMP scripting and file format support as an example). These are not all problems with FC development but some changes that are not fully implemented as FC is a development package anyways.
Also packages that havn't been made available for FC3 yet.
It is on my Xmas to do list at work to upgrade from FC1 to FC3.
Well, if your issue is with FC3, then maybe FC2 would be a intermediate step for now. It has not gone Legacy yet.
The Legacy Project is supporting FC1 now and from what I've read there I'm assuming that will continue until FC4 is released, but I don't know how quick they are to respond when an issue comes up. In taking a quick look at their updates I noticed the first one for FC1 is dated Oct. 9 2004, and it points to a Bugzilla bug that was opened on Sept. 24. Others seemed to have a similar gap. I'm not sure what their response time would be to a critical security bug.
Upgrading can be a pain, it's true, but if you've ever had to clean up after a system that's been rooted you'll know that's no fun either. It's much better to put the time and energy into keeping up to date. If you are not able to upgrade right now, then another option is to keep your eye out for security related updates and build new versions of the programs from source.
Perhaps this isn't politically correct to say on the Fedora list, but another option is to consider other distributions if you think there may be one that handles updates in a way that works better for you. I'm not religious when it comes to selecting a Linux distro (or even a *nix in general), for me it's about finding the right tool for the job. I started using Redhat Linux back in the 2.x days because I had been using Slackware and found RPM to be a huge improvement over dealing with tarballs. Since then I've used Redhat (and now Fedora) for many projects that I felt it was a good tool for, but not for everything.
Rich