In this case, you’re responsible for packaging it yourself. This usually means specifying the git URL and build options in the manifest. You can see Krita doing this in their manifest because they don’t depend on the KDE Platform, as they need much older dependencies. So they’re responsible for over 1000 lines worth of dependencies.
The Freedesktop Platform is essentially a distribution unto itself, and I don’t think there’s ever been a case of dependencies in that distribution not being kept up-to-date.
Distro libs are less likely to have this happen because very few distros have a bus factor of 1—there’s usually someone who can take over.
Well…debatable. There were over 1200 orphaned packages in Debian last year, many of which had not been maintained in over 3 years.