The best thing to do here is scan the ios versions yourself , you can use Prime to check the current vulnerabilities from the Cisco side and also use McAfee to check against open bugs and anything it can see during the scan
the images only stay as the star or safe harbour version for as long as there are no mass amount of identified bugs or severely critical bugs
example , running 153-3.M5.bin on 800 series last year tested completely clean and was advisable to use this , we scanned it again globally the other day and now Cisco and McAfee are saying don't use it so we tested 154-3.M7.bin and now that's completely clean for now :)
1 You wont get a timeframe as it depends on so many factors, I have seen images online there for a month and then removed as something serious was found and Cisco remove it so no one else gets hit by it
2 you should check each release yourself online and the open caveats for it against the release notes for that version what's being triggered an see if your configuration itself is vulnerable to the same issues they provide , these are only guidelines by Cisco to say currently they have been tested and we don't see any major problems , there far from full proof , everything that's released has bugs and always will , it depends what bugs is in the open caveat section to compare to what might effect you , the more they find as the image moves on the less viable it becomes until either its removed from star status or put into deferred state
saying that you are usually better off using a MD release as its a main deployment version , so personally i would go for that if your not going to go through all the release notes or scan it
