The problem isn't fixing that in one application. It's determining which features are affected, how many of your enterprise's hundreds of internal apps are affected, and then putting together a plan to fix all of them. Often, no one has touched these apps for years, and the people who were familiar with them are long, long gone.

Even if it turns out that none of a company's applications need to be updated, the cost of determining that is far from zero. In larger companies it can be difficult to successfully make the argument for that cost.