The reason that this happens is because each new SDK version can introduce bugs into the game so Sony (as well as Microsoft) allow the developers to use older SDK's for release games (but there is a still a minimum version required and it's something like 6 months).
That gap though is closing fast though. In six months the trick of modifing the param.SFO will no longer work.
That's close. There is a minimum firmware version for every game, and usually it can be up to 6 months behind whatever the most recent firmware release is. If you put a game in a debug console and run the check process in it you will see the actuall SDK they compiled the game with. That's the real minimum version needed for a game. When a disc goes gold Sony puts on the latest firmware version release like you said.