"Shouldn't at some point the cost of all websites in the world being broken on your corporate machines be a bigger problem"

Apparently some IT orgs regard "everything but internal sites being broken" as a FEATURE. Keeps the proles off of Facebook, or something.

Having worked in a large bank, I can maybe shed some light on it. It's all about balancing benefits, risk, cost and opportunity cost. Large corporates typically have budgets for projects/investments and for Business as Usual (BAU). BAU budgets aren't a good place for a big infrastructure change because of all the dependencies that may or may not exist - you simply don't know until you do the project to get it done.

As budgets are scarce and ideas for projects are typically plentiful, someone somewhere has got to come up with a business case for each project and unless the cost benefits of doing it are significantly great then it ain't going to get done - there are going to be better investments for that org. It ain't the techies who are in charge in corporates, they need to do the stuff that the business wants done.

The other lens of corporate IT is that they are typically risk averse and want changes to be controlled. IT folks do not change if they can help it - because sometime upgrading something broke something else or maybe they'd rather to do something more interesting.

Couple of years back when I was still doing stuff for various big companies in Finland, I saw a setup that was quite common:

IE7 for old intranet applications, and Firefox for the rest of the web (and the newer apps)