I've worked in IT in Japan for a little over 5 years now.

Getting people to /allow/ you to patch servers is like pulling teeth. Seriously.

If the OS itself is so far out of date that you can hardly find patches for it anymore, the issue is even worse.

The mere specter of something possibly breaking is usually reason enough in many people's minds to not prioritize security updates, or in some case, flat out disallow them.

Sadly.

Edit: keep in mind that this is anecdotal, I'm sure there are companies that patch their servers properly.