CentOS gets patches as soon as Red Hat publishes the source RPMs upstream or pushes changes to git.centos.org. What can be confusing about CentOS/RHEL is that

CentOS gets patches as soon as Red Hat publishes the source RPMs upstream or pushes changes to git.centos.org. What can be confusing about CentOS/RHEL is that many shops using them are on a release that came out years ago. But that's an issue because Red Hat supports 10 year lifecycles for their releases, and will go on supporting them indefinitely if you pay them enough. All the software bundled gets feature and security updates through it's lifecycle, just without changing any interfaces, ABIs, or version numbers. This is great for shops that aren't looking to operate on the bleeding edge and have expensive COTS or bespoke software stacks sitting on top. Of course, you still have to patch, and organizations can't be forced to do that. Hopefully what you were encountering was just the former and not the latter at those organizations.