All of that thinking is just a bet, against the future possibility of an essential need to patch/upgrade for security reasons. They are reaping the short-term benefit of guaranteed uptime, in exchange for being able to do anything easily when you really have to in future. Because catastrophic events are rare, many companies think they're just being really clever and there are no such consequences.