You’re confusing runtimes with the language. Py27 as a language has no security flaws that would allow a database to get leaked.

People will continue to use py27 going forward with likely a pay-for-support runtime because that’s cheaper and less risky than changing a million lines of python code.