If a company said "you must support DES," I would expect that their cybersecurity insurance provider would start asking them some questions, and if they became indignant that no one would do so, I would expect them to be publicly mocked.

There is one valid excuse for why you must have support for an outdated protocol: embedded / air-gapped systems. For anything else, just admit that you don't want to make the change. That's a business decision, nothing else.