Quoting Kevin comment here:
/sites basically snuck in when we froze 1.0. There are enough people using it that we can't track down (at least, not without alot of log parsing pain) that I didn't want to just tear it out. The correct way to use the 1.0 API is to hit /1.0/sites directly, we make no guarantees about the lifetime of the raw /sites route.
I used to call /sites without api version in my app; it is wrong.