Why does Samsung use an older version of the Linux Kernel (for its Android version)

Only Samsung can answer that. Stability? "It works, so why spend money rewriting a newer one?" Supporting a version costs money, supporting 2 versions costs twice as much? There could be many reasons.

They did change. After June 2, 2014, they came out with a later mod of 3.40, because someone had come up with a root exploit that used a bug in the kernel.