It's certainly not for lack of information.
Most major vendors release security bulletins to customers.
Carnegie Mellon University's CERT Coordination Center releases alerts. These sources are not always perfect, but they're out there. For most companies, the biggest roadblock to fixing known security vulnerabilities is getting information to people in the company who can actually do something with it. If you are like my typical client, a handful of people in your organization track the various security information sources. Worse, they probably don't have the authority to take key production systems offline to apply patches or upgrades.