Pretty much. We don't have IdM, so I can't speak to that, but we rarely patch our Portal, because it's such a hassle reintegrating customizations, and it's so much more labor- and time-intensive than ABAP support packs. Even on the ABAP side, we have to drag our business units kicking and screaming into agreement with applying support packs once a year to maintain tax and legal compliance, and even then, they typically won't go along with patching the whole system unless it's required to support the legal compliance. The conversation goes like this:
Basis: "We need to apply Support Packs."
Business: "No."
Functional Analysts: "What's the minimum we can get away with?"
Basis: "We need to do it or we'll lose support."
Management: "Can we purchase extended maintenance?"
Basis: "We already did that."
Everyone: "Oh."