Simple. Legacy and hubris. Legacy in that some systems were engineered before this was a common wisdom. Also the legacy systems become fragile over time and bot

Simple. Legacy and hubris. Legacy in that some systems were engineered before this was a common wisdom. Also the legacy systems become fragile over time and both engineers and business execs become really nervous about making a large change to legacy systems. Hubris because many business level people (and some engineers) will not free up the dollars and time to fix systems as they feel it is unnecessary and that no one will get to the database. Sadly I did work for a team where the execs recognized we were right for wanting to change the system but wouldn't free dollars up to do it. Worse, to pass security audits they would show prototype systems that followed proper security standards that looked like the primary system, shady shit.