The problem is that as, we and by we I mean we in the WPTavern/WordPress Community, know all about updates. the Boards of Directors/the politicians don't see why you have to pay again to "install it again" because they think once is enough. So when you ask them to pay you for maitenance/updates, they don't see why the need "If WordPress is secure, I/We don't need updates".

Things like this eventually happen.

They worry about how things will break for clients, even though you tell them that you will do the updates at 1am-3am local time, that way the least amount of customers/residents will be on the website.

A website is like a car, there is more costs to it that the costs of acquiring the website/car.