In reality, one massive update is too big to digest and it never happens. So you're stuck on out-of-date packages having lost the ability to update.

That's never a problem until it suddenly is. Company is put at significant risk (courts want to reason by analogy and "engineers skipped maintenance and endangered people" is an easy one) and nobody is to blame since nobody owned the task.