a) Do we really want to do such release?

It's unlikely to think we'll never need one. 7 years support is a long time

b) Who's going to do the backport?

Someone on our team? Unless you find a volunteer..

We don't have a strict rule, generally I cherry pick them when merging if it's trivial, if it takes more than a couple of import conflicts it's nice if the issue resolver can send two PRs .. essentially it depends if we think a second pair of eyes is needed.