As someone who works at a company with an old horrible code base, for me its not so much of it can cause bugs, but it presents people from doing stupid things. In parts of a codebase we have a long legacy function that contains a string that tries to show what "state" a process is in, but the string is only ever used for that. Never is it actually used by the system. So we have code that looks like this

  public void processTransaction() {
    string state = "start";
    getCardDetails();
    state = "serialize";
    serializeCardData();
    state = "send data";
    sendData();
    state = "check return code";
    bool success = checkReturnCode();
    if (!success) {
      state = "failed";
      doFailThing();
      return;
    }
    state = "store transaction record";
    storeTheThing();
    state = "complete";
  }

First, this code is a simple example, in reality, the code has bunch of branching and doesn't actually call out to functions to do things like "getCardDetails," so just replace that function in the example above with some parsing logic of a string to parse Track1 and Track2 data. The equivalent method we actually have in our code base to do that is ~1500 lines of code. But that string is doing nothing that a comment couldn't accomplish. Or more importantly, what the code could describe itself if it actually adhered to good design principles. Ideally, I would refactor this, but the owner of the company is adament on keeping this 1500 line abomination untouched.

For me, I often unused variables in production code are usually filling the void a comment or good design would have filled.