It's one of those things... Their longtime developers, by now, know it so well that switching is going to hit their productivity; and it's been audited and hard

It's one of those things... Their longtime developers, by now, know it so well that switching is going to hit their productivity; and it's been audited and hardened for so long that, for a project whose reason of being is security, abandoning it would incur serious risks. Like with binary patches, moving from CVS is something that they will never do until someone "inside" decides that it's time to do it.