Having better up time doesn't mean you don't install security patches. Typically, things are set up so there are redundant servers that kick in while the other one has maintenance ( software/hardware) done. But its also possible that they didn't allocate funds for that. I was thinking with more allowed downtime, that would allow for broader network changes to be done. And to be fair, all of that could be avoided if there was another data center set up that we could push traffic to and we had BGP set up. So, really its always a trade off between cost and uptime.