Corporate behemoths are going to keep doing what they do best.

Their ISO-whatever certification says they gotta get that kind of software, so they do. Whether it is found to actually increase business risk does not matter in the slightest, what matters is that a box is checked for the audit.

It's like Oracle or IBM, who did not contribute anything of value to the world since about 2005 and notoriously have some of the most aggressive licensing lawyers on the planet. But there are lots of companies out there who sort a product segment from Old to New and pick the first result on account of the fact that it's "established", "reputable" and "reliable", every other consideration be damned.