Why is that frightening as opposed to any other older web server code/api that is out there? Or even newer code for that matter?
It tends to be very procedural code with lots of "libraries" that rely on side-effects rather than abstraction. The kind of thing where nobody understands how core concerns (like security) work, they just "know" it seems to work. Except those in the know, know that it doesn't always work, but it's all too fragile to fix it, either.
I know I've been extremely unlucky with the CF code I've had to deal with, but I've also never heard of anybody with a healthy CF codebase they aren't eager to replace.
I have also, over the years, been brought in to rescue applications that have grown into giant messes. So I'm not saying what you are saying is incorrect, but it has less to do with the language, in my opinion, and more to do with what happens to large applications that get written by multiple teams of people over the years, as they adapt to changing customer demands.
And, sometimes, by managers who don't understand code, the importance of documentation, or how to communicate and plan for business issues.
Build an app in any web application today and try to maintain it for a decade.
My point is that a lot of the things still running around in ColdFusion aren't there because they're healthy, they're around because they are too sick to do anything else with. I've got too much personal experience with applications used by the government that I sure would not trust with my personal data! You know, things written before password hashing was standard practice ... and that still don't hash passwords.
Presumably if your codebase is healthy, there is structure and documentation that would make it comparatively easy to replace in a different framework as requirements evolve. Unhealthy codebases don't have this so that stick around without adapting/evolving
Then there's old code that barely worked when it was new and is held together by duct tape. Often it's written in something antiquated like VB6 or COBOL and is very troublesome to replace. (Not that all VB6 or COBOL code is bad, mind you, but as soon as you get out of their problem domain things go downhill fast.)
Then there's ColdFusion.
--
(In all seriousness, I'm sure there's good ColdFusion code out there, but the stuff I've seen is like a weird mish-mash of all the bad parts of PHP with all the bad parts of ORMs and all the bad parts of XSLT.)
It's like a case study in all the bad things that can go wrong when you mix government projects run by people who didn't know what they were doing with 10-15 years of neglect, but need to keep the software alive because it supports a critical government function but there's nowhere near the budget to rebuild it properly.