Service packs vs CU is a pretty moot point for many companies as they dont know about either. They may not even remember which version they have in the first place.

3rd party vendors dont like sticking their necks out to say we recommend anything if they think they are going to get blamed and have to unexpectedly develop a work around. So what do the thousands of small clients do other than not sp/cu