The reality is that most customers do not care about security, which allows companies to basically ignore it until there is a high-profile case directly attributable to a flaw in os. Which might be then individually fixed, with no fundamental changes to a general approach.