On top of that, I've seen code rely on the *presence of bugs* and break if those bugs are fixed. Sure, the code shouldn't rely on those bugs, but often it's nasty closed-source stuff and when you contact the vendor they say 'yes, this is fixed in the next version, please pay $$$$', and because it's closed-source you can't fix it yourself even if you want to.
Sure, for everything other than kernel and daemon bugs you can work around this with suitable library paths, and for kernel and daemon bugs you can work around it with a VM, but if you need a complete virtualized copy of the pre-updated RHEL to get things done, the updates really have done harm, even if all they did was fix bugs.
RHEL is for stability hounds, and often what matters there isn't that there are no bugs but that *the set of bugs does not change*, so the users can consistently work around them.
As a developer, I hate this crusty stuff, but I understand why the users like it.