I can speak from the enterprise side of this. Typically this is done because the work required to certify a new version (either internal or external certificat

I can speak from the enterprise side of this. Typically this is done because the work required to certify a new version (either internal or external certification) is prohibitively expensive. For core, business critical systems, a lot of large, non-technology businesses simply don't have a mirrored QA setup with enough coverage / integration simulation to work up through. So... faced with a heavy testing price to upgrade, risk due to incomplete testing environments, and known current version behavior... a lot of businesses punt and say "We want our version + only the fix for this issue we're experiencing." It's annoying from the software vendor side (QAing old_version + patch_x2 + patch_q5), but it absolutely makes sense from the business side. The summary reason is: because the customer doesn't have a flexible and testable infrastructure configuration. And that's not really something a software vendor can change.