I could really only see that if your job title is "IE11 maintainer" and for the next 10 years you clock in, drink coffee and chat while waiting for a CVE to com

I could really only see that if your job title is "IE11 maintainer" and for the next 10 years you clock in, drink coffee and chat while waiting for a CVE to come in to fix. But you'd still rather not touch anything because there's really only risk and no reward to it. Realistically it'll just be part of a far larger security team that fixes bugs in a large number of software preferably prioritising bugs based on severity where there's always going to be something better to do than mess with old codebases.