It's not clear the ROI ever pays off. A rewrite will likely introduce plenty of CVEs that weren't present in the original code -- possibly more than are fixed,

It's not clear the ROI ever pays off. A rewrite will likely introduce plenty of CVEs that weren't present in the original code -- possibly more than are fixed, for many years to come.