A configuration file is (usually) read at application startup. A database field is (usually) read on-demand. If an application is long-running, changing a database field can have disastrous consequences. Note: "can" means "greater than 1-in-10_000 chance".

Let's take your 28th state example. If you add a 28th state, you probably have to add some more code to handle things like the appropriate tax rates, shipping rates, and various accounting rules needed for your 28th state. You probably also need to add product restrictions, commission changes, and various other things. It's never just "flip a switch and turn it on."

As for application updates being refused, I still maintain that you may not have all the information. While there are stupid people everywhere, stupidity is relative to the topic at hand. I once found a bug in a shared application that was causing my application problems. I read the code, wrote a patch, and was able to prove the patch was mathematically correct. The change was denied, and the denial was correct. By changing the app that some 30 other apps depended on, the testing burden for all those changes was herculean. While the change most likely would not have adversely affected the running of those other apps, it might have and no-one was willing to take the risk of losing the company millions of dollars.

So, while I was correct in my patch, the people refusing to apply it were also correct, even though they were "against" my correctness. Sometimes opposition is in skew.