they might run Debian but not upstream Debian/stable

you mainly find that with systems needing certification

this are the kind of situations where having a C language spec isn't enough but you instead need a compiler version specific spec of the compiler

similar they tend to run the same checkout of the OS with project specific security updates back-ported to it, instead of doing generic system updates (because every single updates needs to be re-certified)

but that is such a huge effort that companies don't want to run a full OS at all. Just the kernel and the most minimal choice of packages you really need and not one more binary then that.

and they might have picked Debian as a initial source for their packages, kernel etc. but it isn't really Debian anymore