I'm wondering about this, too. There are so many things being redone from scratch that I'm scratching my head about the why. Maybe Microsoft lost so many engineers from the 90s that they don't have the people anymore that understand the old code.
Understanding old code rarely gets one promotions.
Somehow, it's gotten me promotions and raises. I feel like I'm lucky and should stick around.
The problem here is due to a lack of basic security practices. There is nothing related to old code, it is brand new code and infrastructure that was deployed without audit.