The problem with allowing admins to manage updates is that any new version which breaks an internal app in the slightest way would be a reason to avoid updating

The problem with allowing admins to manage updates is that any new version which breaks an internal app in the slightest way would be a reason to avoid updating. This is what has given IE6 its long life in the corporate world. While this is a pragmatic decision, it can hurt badly in the long run as we all know.