> I think issues left open > 12 months is antithetical to the idea of lean/agile and could be a sign of suboptimal project management.

Totally depends on the nature of the project, its policies and users.

Any popular FOSS project that allows anyone to post a bug, and doesn't just close unattended bug reports (which is bad imho), is likely to end up with some (usually minor) bugs open over 12 or more months.