They don't seem to see how this negates the advantage of using a "well tested, enterprise grade" distro!
I much prefer Debian (for servers and development machines) as a good intersection between "up to date" and "stable".
The thing I find strange is that the people I'm talking about will happily run code from random 3rd party repos (providing PHP 7.0 or similar), and copy/paste repo key fingerprints from the web without blinking, while steadfastly refusing to use an OS with such packages included and tested in the official repos "because security/quality/enterprise".
For the record: I have no idea how the package selection compares between CentOS and Debian - I've been firmly in the Debian camp since forever, and stay there mostly for other reasons, of which laziness is the most important one.
At my new job, we recently had that debate -- and I was quickly overruled for recommending CentOS/RHEL. My employer is a Java shop, I can almost always find rpm and deb pkg's for most stuff we need.