This is often the result of poor risk management or lack of risk management understanding.

Compliance assessments at least the assessments I have worked with, take a risk based approach and allow for risk based decisions/exemptions.

If you have a vulnerability management process which takes what the scanning solution says at face value and therefore your process assumes ALL vulnerabilities are to be patched, then you're setting yourself up for failure.