[ethbro]

This will only be a solution if it addresses the "business critical application, vendor has gone out of business, no source code available" case.

Which ultimately comes down to "Who's going to pay for a more secure replacement?" & "Who's going to assess heavy-enough fines to force the replacement risk scales in favor of doing something?"