An auto-updating OS doesn't really help you with web application vulnerabilities. Even something like Clair would be unlikely to help - they likely knew about

An auto-updating OS doesn't really help you with web application vulnerabilities. Even something like Clair would be unlikely to help - they likely knew about the numerous struts vulnerabilities they faced and simply chose not to care (and prioritize other more exciting business prospects - like selling identity theft protection)