It definitely depends on the company. There are a few companies that are pretty fast to update including Github. Many are ok like Twilio, Atlassian, and Mailgun (not super-fast but definitely updated pretty consistently). Then it follows a long tail where you have companies like AWS who only update after major outages and usually after an hour. Symantec is probably the worst case where I've seen that they started updating and then forgot to finish updating.