My old job had so many unpatched servers, mostly Linux ones. Because of the general idea that "Linux is safe anyway". And because of how Windows updates would often break critical infrastructure, so they were staggered and phased.

But we've seen plenty of infected Linux packages since, so it's almost a given there's huge open holes in that security somewhere.