That "customization" definition is not quite right. Configuration is not typically called customization. A lot of companies use "Z" programs (a prefix indicating something is custom) to front-end or augment existing SAP functionality. Companies may also create user-exits in SAP programs, or additional code to run when something happens ("send xx an email when the first sales order for a customer is created", for example).
When they upgrade, these additional programs require regression testing. Those programs make upgrades risky, and those programs may need to be rebuilt. Historically, companies built a ton of these customizations, then had issues during upgrades. The most recent model (since S4 and HANA emerged) is to do as much as possible in configuration, and limit customization.