ASLR is a stopgap that's difficult to consistently apply to a legacy system, since there's so many ways to accidentally leak address information.