I used to work at a web agency who did’nt care about upgrading unless the customer directly paid for the upgrade. So instead we used alot of time to fixed those sites which got hacked WITHOUT the customer paying.
I hope thats not the attitude elsewhere.