I think it's common in libraries of small to medium size. I often see Haskell and Rust packages that are not updated because full functionality achieved, no bugs and 100% test coverage.

Absolutely not the case with enterprise software. Zawinski's law is truer than ever: https://news.ycombinator.com/item?id=20165602