A common answer to "we depend on this application that only runs on Windows Server 2003" is "well, use Citrix jumphosts to access the insecure app running on the insecure server and you can call the risk mitigated!"
Honestly, you would be surprised how many giant companies still use Citrix. Mostly medical. Terrifying.
And financial companies
And law firms big and small.
Hospitality as well.
And places that use RDP like setups for development because they don't want their employees to walk out with the crown jewels on their laptops.
Why not just use RDP? It is because it as hard to get an enterprise to stop paying for a software license as it is to get one to start?
I've sat in many pitches where, ironically, the argument is that Citrix is more secure.
We use multiple desktop products where the modern cloud version was literally just a Citrix cluster per customer, running the same old app. It's absolutely endemic across enterprise products as a "cloud solution".
Citrix XenApp or whatever it's called this week is a lot better marketed to enterprise and offers a lot more integrations than Windows MultiPoint/Terminal Server. But a lot of is history, Citrix was a close partner of Microsoft and so Citrix essentially was RDP in this context for some time before Microsoft decided to try competing on their own. Microsoft's entries have never really caught up in terms of adoption or features - for one, Citrix supports just about every platform there is for the receiver while Microsoft only has an officially supported RDP client for a couple.
Oil companies as well. Essentially a way to keep everything behind a VPN and "on-prem".