I can’t speak to mail/cloud providers, but the big difference between 99% of open source software and proprietary software is that updates are manually installed by the user.

In theory, this allows the user the opportunity to read the new source before installation to verify it isn’t malicious or to check for any known compatibility issues or bugs.

For instance, “stable” Linux distros are not stable in terms of not crashing, but stable in the sense that functionality will not update and only security patches are applied. But the user always gets to choose when that happens.