By having externalized some of the tight coupling into some config file (like Spring's XMLs), they can go in and say that the AuthorizationFilter is OAuth20Filter instead of OAuth10Filter, or maybe their CookieParser is StrictRFCCompiantCookieParser instead of the WhateverGoesCookieParser.
The same would be doable if you compiled all this into code and only exposed some different config parameter that says "enforceRFC6265Cookies=true/false", but then the customer couldn't use some consultant company's SuperSpecialCustomCookieParser class in its stead, whereas with Spring they can.
But say none of this applies; DI is often used in testing. You can inject a mock class with next-to-no effort without having to figure out what to do about all of those StorageManagers whose hardcoded dependency is your ActuallyRealDatabaseStorageManagerImpl.