That is because you only hear about those cases where it did not work out. Take a look at for example Apple's release notes for a security update: dozens of fi

That is because you only hear about those cases where it did not work out. Take a look at for example Apple's release notes for a security update: dozens of fixes, most reported by external companies and persons, all with proper attribution. I'm fairly sure that the process does work most of the time.