Lots of places are still running Windows 2003 or 2000 and thus have critical infrastructure that uses NTLM.

Also, many, many places who do upgrade turn on legacy crap to interoperate and never turn them off. It's a lot of work to disable it, and the systems that still use it are usually old crap that isn't budgeted.