yes if you see the shared sunrise project there is a review:
so... this guy who "made" this pack is making money from noobs, now there is another guy vilmis who's selling l2jfrozen pack
this guys have in common that they scam noobs to get their money simple as that, decent packs are acis, l2jserver, lucera, mobius in this order, with them updating stuff is most possible you wont find any code leaks or performance issues, and to answer your question they dont know how to upgrade or what to upgrade this guys dont even know how to read java manuals or stay updated but scaming money from noobs is easier.
hope to answer your question.
PS same goes for l2scripts but still there are people who pay 2k euro to get it.