again: not everything sits on the public internet, and by the time someone gets access to the application there are far more serious concerns then python 2 vs 3

this also really highlights the problem with python's 2 vs 3 split: there is a large body of work that will never be updated and will forever run 2 including actual web/publicly facing code. And saying "just upgrade because security" isn't going get much of that code upgraded.