[adrianN]

It depends on the industry. In some places changing a dependency, no matter how trivial the change, entails a lot of work. Think for example about embedded systems where deploying is a lot harder than pushing a Docker image somewhere. It is often far cheaper to analyze whether the fixed bug can be triggered to avoid upgrading unless necessary.

[bunderbunder]

In those situations, why not go ahead and keep the code up-to-date and consistent, and simply not deploy when you don't need to?

[adrianN]

Because that costs money now that could be spent on something that actually produces a profit.