> 3) where there's legacy, there's most likely outdated practices like SQL queries from string concatenation or unescaped HTML output.

If you combine the article's findings with this observation, one could foresee sending a crafted /footer.php?args=SQL+Injection+goes+here type request that skips past where input is "sanitized" and results in code injection.

(Further details are NDA'd, but I've found similar issues before in production systems.)