In the spirit of maintaining my argument...
The company should light a fire under the ass of their vendor or development department if they're being forced to live with some very serious security risks.
The vendor doesn't exist any more. This is a realistic problem. They had source escrow which results in them hiring a development team to port it. This has taken 4 years, including retraining all 5000 users and porting data. This isn't some shitty TODO list app or an Intranet - it's a full ERP with over 2 million lines of code and 500Gb of raw non-binary data. And yes this is still cheaper to run than SAP/Oracle.
Why are you supporting software that is a quarter of a century old? If it has undergone significant rewrites to work on those new-fangled color monitors, then you understand why things need to be upgraded.
Because the 30 year paid for and guaranteed support lifecycle isn't over yet. Not only that, it's tied to the specific hardware platform which is an embedded 80286. It doesn't have a monitor attached - it has a 40x8 text LCD screen and an RS232 port. New requirements and bugs do appear.
What is "non-engineering background trendy startup pushing culture" supposed to mean? While HN has a charlatan element, you can't legitimately think that the startup culture here isn't dominated by engineers.
I use the phrase engineer loosely with respect to software as it has in the last decade or so come to mean a different thing. It's gone from individual who carefully plans and creates something with meticulous attention to detail and extensive knowledge of requirements to individual who makes something with little thought. Note: this isn't every case but it changes the meaning of the word, much as you can say "I love you" too much...
Do you also scream "la la la" while the tips of your fingers are lodged in your ears whenever in architecture meetings? A web browser is an ideal consumer (ubiquitous, cross-platform, cheap) of a large number of business applications and high availability demands writing software that's internet-aware (that feels so strange to even have to type).
Yes, it's actually my job to ensure that due diligence is done and put good engineering standards and technology in place. La la la doesn't cut it but I have to think ahead 20 years in some cases and make a call. If something doesn't make sense in that timescale, then it gets discarded. Your personal opinion isn't necessarily that of a risk assessment.
It sounds like your perception of the industry is antiquated. A 10 year cycle without maintenance to keep the codebase secure/running on modern hardware/platforms?
Industry? There are two industries at the moment. The one in the technology press and everywhere else. I firmly circulate in the latter. There is not a noisy presence but a large and realistic one that makes critical cogs turn behind the scenes. Whether or not this is "antiquated" or not is purely conjecture.