The legacy policies are disabled because they are not authorized for usage by regulations (NIST and co). Old large organization are compliance and process orie

The legacy policies are disabled because they are not authorized for usage by regulations (NIST and co). Old large organization are compliance and process oriented. They run security audits that scan machines, finding X version of software that's end of life and Y cipher that's insecure, then raise control breaks to the systems owners to resolve.