If it's anything like ours, they don't like to touch systems that 'work'... They don't have the resources to audit, update, and re-train everyone to use the current version.

Then there are the students hired to build internal tools who wouldn't know SHA1 from Bcrypt/Scrypt...