It's just a defense program with a very very long timeline.

IE + Java applets? Who were you defending? The Carthaginians?

I would worry about long term availability.

For that type of project, it might be worth it to write a detailed spec for how the back-end talks to the front-end so in the future it's possible to write a more modern client.

I'm not sure you appreciate how much work it is to both "write a detailed spec" and then also to "write a more modern client".

All of that on top of a system which has likely changed in the intermediate years. Basically, you might as well milk the existing system for as long as possible and then replace it with a completely new system that probably runs on newer hardware (1990s instead of 1980s), is much more maintainable and does things in a more modern way.

Who defends the defenders? Sounds like a secondary (tertiary?) business will spring up to plug the security holes in these defence technologies

Wait, you're serious?

In 2014 the healthcare IT company I left was running this plus ActiveX controls written in Delphi

This wouldn't be Craneware would it?

No, NuMedics.

The other day I was inspecting some software for an industrial pump to advise how to customise/debug it and sure enough the source code is in some proprietary language which compiles into a Java applet.

Not sure when was that app written, but the control unit was assembled just months ago.