Because they have enough staff to detect and fix vulnerabilities within hours, if necessary. For a company without these resources (and maybe even larger ones), hiding servers from the internet can greatly reduce your attack surface.

because the company's IT people can't manage to keep all those self hosted systems up to date and secure