Sure so they learn classic ASP in a day, now they have to code their own custom routines for XSS protection, SQLi Protection, SSRF protection etc etc etc or...

Sure so they learn classic ASP in a day, now they have to code their own custom routines for XSS protection, SQLi Protection, SSRF protection etc etc etc or.... they could move the application to a supported platform with a wider developer base and in-built protections against common web application security attacks. There is a reason why most web app developers do not hand code their entire stacks. For example why ruby web developers use rails. Web app. sec. is a a relatively complex field to get right, full of edge cases. Having each and every web app development team take the time to understand all those cases and edges probably isn't the best use of scarce developer resources.