/sigh - didn't we go all through this with the Olympics thread in the news the other week?
Testing, certifying and securing any business-critical application (and by application I mean role - not just one piece of software) takes time - lots and lots and lots of time. You don't go for 95% proven for your task, you go for what is 100% documented, understood and is totally reliable for your given task. The IT managers in charge of that project will have satisfied themselves that Vista has the stability they need for what they need and that 7 - while the newer and potentially superior product - just doesn't have the milage yet. I've handled implementations for a couple of thousand users on Unix, Windows, VAX VMS (those were the days) and several other platforms I choose to forget. Stability, TCO and predicability is all that matters, not that you are on the latest and greatest.