I mean the whole software development industry, and arguably developers working worldwide on "line of business Java applications at huge insurance companies" a

I mean the whole software development industry, and arguably developers working worldwide on "line of business Java applications at huge insurance companies" and the like far outnumber the developers in "startups where software development is a profit center". And even in greenfield development in new companies you still routinely see things like simple SQL injections or hardware with hardcoded trivial credentials. The future is already here, but it's not evenly distributed, and lots of new things are still made with very not-modern development practices - it's not only about legacy code, there's lots of new sloppy insecure stuff being written every day.