Because nobody got around to fixing it yet. Infrastructure can be built to keep these packages' dependencies up-to-date by default. If they break on dependency update, the maintainer should be alerted, and the package should no longer be recommended until it is fixed. Relying on individual maintainers to do everything correctly themselves has never worked.