Because people don't know what the term "patch" means. The data for the items and mega pokemon are not in X and Y, in order to ADD the data, all the information would need to be completely rewritten. (Can you ad a 3D rendered Arwing in to a physically copy of Super Mario Bros on your NES using just your NES? no.) the 3DS is not capable of altering the data on a physical cartridge. It WOULD be possible with the digital only copies of the game by simply overwriting the data on your SD card (it's exactly the same as rewriting an app on your phone or tablet) but Gamefreak is not going to update the data for one and not the other. People don't seem to understand that "patch" and "DLC" are two completely different things and fixing the way the 3DS interprets online communication to trade/battle or altering a character from being frozen in Lumiose to not being frozen is fundamentally completely different than adding new character data, polygon models and item data and telling the game what to do when it encounters this item, that character or whatever information it was never programmed with in the first place. a Patch isn't come magical switch you flip that turns Duck Hunt into Call of Duty, it's a software fix to a software error.
People think that "Oh, my ________ game can get downloadable content, so it MUST be doable on every device there is!" when the way DLC actually works is that the game, first and foremost, must be programmed with downloadable content in mind. Second, the thing people ALWAYS forget is that (in the most basic sense) most downloadable content isn't ACTUALLY downloaded, a lot of it is already in the game and you're simply getting the unlock switches telling the game "Yes, this can be accessed by the player now" and everything else the game is already programmed to have this, that or the other (characters, maps, custom whatevers) particularly when cartridge based games are in play (suchs as 3DS games) for example, New Super Mario Bros 2 had downloadable levels, but the levels were actually already built into the game, you simply purchased the switch to not only tell it that you were allowed to play that level, but also the information from Nintendo Servers to tell the game how to build that level. There's never been any new DLC for it, and there never will be because the game was built with only those levels in mind. If a "Patch" could fix that, there would be more levels but a "patch" is not the same as "DLC" Second, Animal Crossing. A game built on DLC both from Nintendo and from other players. Again, all the items are already built into the games, you don't actually GET anything from nintendo or the giveaways, all the data is already built within the games (as was evidenced by the strategy guide and online sites listing every obtainable item the day the game came out) no new items have ever been released, only items that the game already and built into it, and Pokemon is exactly the same way.
Yes, there are mods and hacks and such on cartridges from all kinds of consoles, that is not a question (because people will bring that up) however, not a single one has ever been rewritten using only the console it was meant to play on. the RAM and ROM on a cartridge can absolutely be rewritten, there's no question of that, the thing is that it cannot be rewritten by the device itself because the device was not designed to alter physical game cartridges. Can your toaster out of the box make a milkshake? No. Can your 3DS rewrite the data on your cartridge (other than the save file) no it cannot.
DISC based media on the other hand is a completely different thing (because people will ALWAYS throw that up as the example) but people don't seem to get that dic based media is different than cartridge based media. Again though, the games are limited to what the game was designed to do. if a dic game was built with no DLC in mind, can you play Super Mario Bros U using MewTwo instead of Mario or Luigi or one of the toads? No. Can you download a patch off the internet that lets you do that? No. Can you download a digital game off that internet on your modded Wii U that lets you play a hacked version of the game someone designed to be able to use MewTwo as a character instead of the default 4? Absolutely. But that is not rewriting the game (cartridge or disc) using nothing but the console itself. If the game didn't have DLC in mind, you can't make the console it runs on rewrite the data or add content into it that it wasn't designed to. And I know there's going to be a whole ton of people arguing about theoreticals, but to them I say: "Show me a cartridge that has been rewritten by the consumer level console it was built to run on."
And yes, I know people are also going to say "Oh well they could put the data on the SD card and then have the 3DS access the information from there" but again, the original game would need to be designed to be able to access information from two different sources at the same time, (not just a patch to an online connectivity error which the console itself uses, but actual polygon, character and data content from two sources) and if the original game was not designed to do so, it won't be able to. and seriously, you can't even run a game and change the date on the 3DS at the same time, how is it going to handle accessing two sources of game data? And further to that, if you have a battle with 5 Roselias or even have Rayquaza mega evolve the game slows down and the frame rate drops because the game can barely handle processing the data that's there in the cartridge for that particular instance, does anyone REALLY expect it to be able to handle data for pokemon it was never designed with from one source while simultaneously accessing from the other?
So to summarize, if Pokemon was ONLY digital, yes, they absolutely could have updated for the new items and moves and pokemon, but there's physical games, the 3DS is completely incapable of rewriting game data on a physical cartridge and they're not going to update some people's games but not the others. And even if people do still insist on discussing it, for the love of GOD can everyone stop using "patch" as the be all magical term since it is not a Patch at all?? It's like going to the doctor and asking for a "thingy" when you mean to say "Antibiotics to kill this flesh eating disease before I die" .