Because they have enough staff to detect and fix vulnerabilities within hours, if necessary. For a company without these resources (and maybe even larger ones), hiding servers from the internet can greatly reduce your attack surface.