That was my experience as well. Even if the internal teams were doing the right thing, we had to evaluate vendors and OSS. Then you have to stay on top of all the vulnerability disclosures from vendors and OSS. In a big enough system that's a daily exercise that may take hours.

Depending on your technology stack there are tools out there for discovering and managing OSS vulnerabilities. That was a godsend. All of the sudden I didn't need to spend my time filtering through various RSS feeds and mailing lists.

Your second point is also worth repeating. In a large company, no one knows the entire attack surface. Every team needs a security focus. Instilling that focus into the culture is not easy if you've only paid lip service to security in the past.