You've conflated being able to use legacy apps which require a very specific stack of components with the complete absence of any such components. Additionally

You've conflated being able to use legacy apps which require a very specific stack of components with the complete absence of any such components. Additionally you've failed to recognize that where legacy code is maintained Exactly As Is (bugs included) because users (corps and gov mostly) explicitly depend on behaviors remaining exactly as they have been for 20 years, there is effectively zero means/will to fix dangerous problems which are not being actively exploited. And the mantra around obscurity is too often misused and misunderstood: It's not that obscurity is not a form of security it's that its not a meaningful form of security On Its Own. Obscurity is in fact the first line of security. Just like with physical security, the first step is in preventing attackers from knowing it exists at all and Then having security measures to prevent access/theft/etc if they do happen to find what is being protected. Y'know, like safes behind paintings, which are a very real thing....