Make sure you're including all the lines, including those in libraries/frameworks you reference. Because they all count towards your MTBF.

Having not worked on large scale systems like what I imagine they must be working with, is this really true? I would have thought that a modern framework would make things easier. I've certainly had life made easier by modern web frameworks like React and Angular, although the support timeline is more on the order of 2-3 years, rather than 20-30.

Not sure, what if you have an enterprise system that uses a few hundred docker containers and at some point in 10-20 years there's a major vulnerability that can only be fixed by breaking compatibility for one function? Securing that system could be significantly harder than fixing a monolithic system.