I agree with that. Folks are forced to create little isolated environments that are less likely to be patched or monitored, for fear of bringing more systems into PCI scope.

That is slowly starting to change however. PCI DSS 3.0 gets a bit more specific and starts to go down some technical rabbit holes. PCI DSS 4.0 will be even more specific and have more technical requirements (vs. checkboxes)