Based on the corporate IT emails I receive from time to time, it also sounds like Apple enterprise management controls are weak to non-existent. A few times a year, there is a blast sent out to not upgrade your corporate iphone/mac because of some incompatibility. In the Windows world, IT would just hold back the patch without requiring N users to do the right thing.

This is true. Anyone who needs to manage Apple devices in a corporate IT setting is probably using Jamf.