[pseudohadamard]

Some software does. If you've worked on SCADA gear it's expected to go into production and then run for 20-30 years without being patched once a month, or, actually, ever.

Someone once asked the author of an at the time widely-used security utility why it hadn't been updated since 1996, and whether it was abandonware. His response: "No, some people just get it right the first time". Just had a quick check and there's a single CVE for it from 25 years ago, possibly from a third-party mod rather than the original code.