I think it’s more of the testing of patches or features. I’m not sure what their quality control is like, but I think it’s the lack of testing that is a big concern.
But I don’t follow their forums closely to see if a lot of issues arise after patches. I also think it comes down to tolerance. If users are willing to accept some flakiness then have at it. I’m also not saying that pfsense is an easy ride either. They had a bad patch for HAproxy not long ago which took me down. But it is fewer I would say between the 2.
I’d argue stable is something you control through your processes, not something you get from a vendor. Do you use snapshots, backups, load balancing, segment services, pre-production testing, etc?
Updates come at us non-stop whether our platform delivers them to us immediately or not. Most updates are bug-free, few are not, none are guaranteed. If your only process is to rely on your platform vendor, then you aren’t super concerned about stability. Fair enough, click the button and trust in the 99% odds things will go your way.