I don’t know specifics and it depends on each country, but there’re regulations about software having to be certified to fullfill certain conditions (e.g. security updates, permissions, etc). I guess this is probably mostly the case for defense or medical contractors.
And it’s not really that other OS don’t fullfill those requirements but mostly that they aren’t certified, at least that’s how I understand it.
I can’t really write more since I don’t know myself. The point was mostly about why some companies couldn’t just switch to another OS.