I think they just didn't want to bother getting it in an out of band procedure so they're waiting for a patch window.
Which is a bad choice considering the impact imo.
The problem is as organisations grow, the more governance types get involved and slow things down with arbitrary rules.