It's almost certainly due to supporting platforms like VAX and other, more exotic ISAs. GCC can have weird regressions [0] in "less tested" architectures, so I presume they use a single, known good release across all platforms for consistency's sake.

[0] GCC still supports PDP-11, for example, but for a while modern GCC had some major codegen bugs. Last I checked, the maintainer had made heroic efforts to fixing the bugs, but that's just an example of where bitrot silently renders a target unusable.

They don't like GPLv3. The other BSDs used similarly old versions until they moved to clang, but netbsd is pretty tied to the gnu toolchain and aims to be as portable as possible, so they kinda have to stick to gcc