Yep. Making a new thing is how you get promoted. Maintaining or improving an old thing is nearly useless, even at companies with competent managers.

This is the same reason why a lot of companies have awful security practices. From the managers' perspectives, they're burning valuable engineer time on something that doesn't produce any tangible benefits besides reducing the possibility of a lawsuit. And that lawsuit is probably cheaper to just pay up, rather than pay for all that engineer effort.