Umm...they can? Do you have any examples of this? All this time, has it just been that Windows security vulnerabilities have been found on the second Monday of every month?
Even for trivial stuff. Why? Cause in a a giant corporation, even a hotfix takes ages to get through all QA.