Has everything to do with "we won't challenge the system and propose changing how we actually build software because doing so will lead to us losing the contract, so we'll build upon these antiquated frameworks that will become harder and harder to support and sweep the problem under the rug long enough for me to buy another $EXPENSIVE_THING"
From a technical perspective, this is a terrible approach.
From a "look, we all just want to make money here, right?" perspective, makes total sense.
It doesn’t. It’s not an attack on the programming languages. It’s just that they have a sweet spot for using old ass versions which might or might not have known vulnerabilities and they don’t care about updating it.
FYI, OpenJDK 8 still receives regular security updates and will continue to do so for at least three more years (Temurin, RedHat) (or, according to Oracle, until end of 2030). It’s still in production in a lot of places.
Has everything to do with "we won't challenge the system and propose changing how we actually build software because doing so will lead to us losing the contract, so we'll build upon these antiquated frameworks that will become harder and harder to support and sweep the problem under the rug long enough for me to buy another $EXPENSIVE_THING"
From a technical perspective, this is a terrible approach.
From a "look, we all just want to make money here, right?" perspective, makes total sense.