Sure old != bad if they maintain it... Classic ASP was good 20 years ago, it's harder to secure than a modern framework which helps with security (e.g. XSS helpers, ORMs to help mitigate SQLi, which is one of the issues exploited here)

The problem is that in most codebases I've seen, once you get to 19 years passed deprecated, it's not that it's a well maintained hardened environment. It's a poorly maintained environment that people don't want to clean up for fear they break something.