It may be due to them testing fairly rigorously before deployment and thereby benefitting from the latest kernel security patches, for example. Google does some

It may be due to them testing fairly rigorously before deployment and thereby benefitting from the latest kernel security patches, for example. Google does something similar with Debian internally on workstations.