Like any other business, IT is outsourced and software is often licenced. In such a event i'm sure 99.9% will be patched within an hour. And there's counter measures too to protect any website. Casino's are'nt plain SQL databases with unhashed credit card details or something. We're talking strong encryption that even if you got the details it still would be considered useless due to the strength it's encrypted with.
I mean, when was the last time a casino was really really hacked? Where either personal details where confiscated from players or simply a database dump ended up somewhere? I cant recall really. Casino security is extremely tight. I mean i have websites of clients that are EOL; and leak as a clutter. If it was'nt for the server side protection i'm running those website(s) would be hacked to shit.
With the combination of both cloudflare and server side protection, you can pretty much build a fortress in regards of protection your application. most of the hacks that you see today, is primarily due to outdated software or weakest link type of shit where a unsuspecting employee clicks on a attachment he shoud'nt open, causing a ransom attack to spread out in hours.
Ive hacked too, many years ago, back then it was quite simple. Primarily because of bad configured servers but also bad skillset of programming. Most applications back then just did'nt verify what was actually submitted and that left room for XSS / SQL Injection attacks. Now it's completely different, and most (good) software simply dont trust what the user is submitting in regards of data.
In particular i managed to inject my own user and pass combination(s) into bad configured servers hosting xxx content. Where you normally had to pay for a monthly subscription i pretty much bypassed that and was able to resell even up to 3 logins of choice for only 10$. That expertise helped me in building quite stronger websites today.