Maybe, that COBOL codebase doesn't contain the web-facing stuff. It's not handling user auth and all of that. It doesn't seem to make much sense for the web-fac

Maybe, that COBOL codebase doesn't contain the web-facing stuff. It's not handling user auth and all of that. It doesn't seem to make much sense for the web-facing side to be so directly connected to the financial backend, anyway, because some kinda privilege escalation or crafted input exploit on the web side could give someone direct access to the financial backend. Those two things are likely pretty heavily separated. So instead, it seems like the stuff holding just account holder information was given a password field to use on their fancy new HTML 2.0 webpage, but then just mostly left there ever since. The age of the financial side is fairly irrelevant in this scenario.