This is a huge part of the problem. The amount of risk that exists in legacy systems is actually pretty huge because of the amount of interdependencies that exist.

It's the sort of thing that people who operate those systems know but that knowledge doesn't seem to spread beyond that.