> I'm very curious what organisations would have such a policy.

I would humbly suggest any org of any size that has insurance cover that covers anything tech related (e.g. data loss/recovery, cyber etc.) has a very good look at the small print.

Over the last few years insurers have aggressively been adding "no vulnerability patch, no claim" exclusion clauses.