A thing that I found missing is that legacy systems' influence is much larger than only the systems it directly touches.

Through particular requirements that some of these systems have they might shape policy too!

I primarily deal in security assessments of networks. Guess what happens to your password strength requirements if somewhere deep down in a dark and old server room there is a mainframe that can only handle 8 character lowercase passwords? Assume that this system has been the backbone of your, then hyper-modern, completely integrated IAM system for decades?

...

That's right, security policy mandates 'simple' 8 character passwords... Not ideal.