I am not surprised at all. Technical debt, periodic refactors or security analyses are very low on the list of things that get rewarded, and shiny new projects

I am not surprised at all. Technical debt, periodic refactors or security analyses are very low on the list of things that get rewarded, and shiny new projects are high. That's until a security incident takes place, then people are reprimanded and things will be okay for a month or two. Until that's fixed, things like this will keep being commonplace.