The fix itself doesn't need to be complicated for it to be hard to actually implement. A lot of apps that are affected probably haven't been deployed in years.

The fix itself doesn't need to be complicated for it to be hard to actually implement. A lot of apps that are affected probably haven't been deployed in years. Some won't have any source code available. Others won't have any docs, or tests, or even developers who know the right language. Fixing simple issues in old apps is hard.