It's a hard call for service providers. Sort of catch-22. They have to support old ciphers because most of their possible customers are running old software or operating systems that don't support newer ciphers. So to make money they're effectively forced to take a more insecure position. They can care deeply about customer security, while effectively being forced to offer only the most secure that their customers will support, and having to accept that ugly compromise as a necessity of remaining in business.