Typically this is done because the work required to certify a new version (either internal or external certification) is prohibitively expensive.
For core, business critical systems, a lot of large, non-technology businesses simply don't have a mirrored QA setup with enough coverage / integration simulation to work up through.
So... faced with a heavy testing price to upgrade, risk due to incomplete testing environments, and known current version behavior... a lot of businesses punt and say "We want our version + only the fix for this issue we're experiencing."
It's annoying from the software vendor side (QAing old_version + patch_x2 + patch_q5), but it absolutely makes sense from the business side.
The summary reason is: because the customer doesn't have a flexible and testable infrastructure configuration. And that's not really something a software vendor can change.
Maybe I have more faith in the 'system' than I should...
Different components could be made different companies. While flight controls and handling fly-by-wire could have been Boeing, the FMS could be (e.g.) Honeywell, GE.
The FMS, AFCS ("autopilot"), and (primary) FCS are three distinct systems per ATA iSpec 2200:
* https://en.wikipedia.org/wiki/ATA_Spec_100/iSpec_2200
Things can be more blurred with fly-by-wire, but can still be conceptually separate.