So what actually always happens with this approach is that companies stay on ancient docker images, because there is never time for updates as long as they work.

It's the same with locking python pip packages to specific versions. Nobody ever looks at it again and you run code that is 5 years old in production. People only look at it when it breaks.