Whoch is my point, actually. When AO switched from a short term to a long term MMO, no assessments were done. Noting, just "patch and go".
And yes, Y3K went by largely without a hitch and some companies did risk assessments. A lot did not. I know several freelance coders that made a bundle in 1999 patching databases, because these corporations (not all of them small) did the initial assessments, then 'put off' dealing with the issues until right before, because they failed to prioritize it.