The rubber has to meet the road. Users have to interface with the software.

"Backend" software tends to be very long lived because it's not client facing. Clients don't care that the software was written in Java2 and uses some weird-ass collection of korn shell scripts to keep things moving. These scripts usually just need to eat data from one location, and poop it into another. And because these systems are old, they are well tested and battle hardened.

But that backend is no good without some form of user interface. This is almost always the place where things break down. There are many more people involved in the decision making for UX, and we have more and more devices with different use-cases. Most tech-ish companies can't afford to ignore completely new computing paradigms for decades.

At the risk of stretching the metaphor, what I'm talking about are bearings that separate the wheel from the rest of the car. Maybe you have a thin, outward-facing server that does nothing but authenticate, validate, and sanitize input data, and then redirects that to some internal system that knows for sure exactly what it's going to get, and doesn't get to talk to the outside world directly, and therefore doesn't have to worry about attacks.

Congratulations, you just invented "middleware".