Why are enterprise kernels so old?

That question is easy to answer as soon as you're in the mobile phone space. Proprietary drivers that are "certified" to work with a particular kernel. No sources.

In "enterprise" space there's the lack of exhaustive automated tests, plus managers who convince themselves that a somewhat-random backport to a known kernel is somehow safer than a new "unknown" Linux version.

It's basically the same reason why Boeing went to such lengths to pretend that the 737-MAX was just another 737 — instead of a completely different aircraft that requires ex[pt]ensive re-certification. We know the results.