Reluctant to take risks.
The people involved in using PLCs on equipment are very risk-averse in the sense that they don’t want to be the one who made a machine not work because they applied a firmware update to it.
Source: https://arstechnica.com/security/2023/08/microsoft-finds-vulnerabilities-it-says-could-be-used-to-shut-down-power-plants/