Many companies have the same problems, not rewarding people who fix these type of security issues and look at security holistically, and instead the only path to success is to create new features
It is rotten corporate culture that is starving critical maintenance work at these companies, creating the internet of vulnerable shit.