I work at one such large org. We would pay good money for a 5 year support contract for a fixed version of a framework getting backported security (and maybe a few feature) updates.