They also have more to coordinate and manage. I don’t think it’s fair to frame it as them being bad at something. What they have to do is much harder, and it takes time.

When I’ve worked at small places, a security patch is bumping some versions and restating some servers.

I worked at a massive Rails shop for a decade and a big security bump meant mobilizing a team, coordinating updating dozens or hundreds of apps, all while maintaining platform stability and staying within SLAs. It’s a nightmare.