Hoping for the best is not how compliance works.
But the incentive structure may prioritize getting their deliverables done over doing patching at least in the short term. The corporate hierarchies for IT and their main organization might only have a common manager at the very top of the company.