Well, libs aren't updated that often, but you're right that they don't package themselves. And last time I checked Sailfish used gcc-4.6.x and glibc-2.15 which are pretty old ... but next time there's a major update to gcc/glibc it's common sense to rebuild every package of the distribution. But I'd wager most (if not all) package maintainers already know this.