Is there some fundamental flaw I don't know about in kerberos that keeps people going back to NTLM in this decade?
It's more old products that don't support Kerberos (think old scanners that store scans on a file share, or an old http proxy), or the fact that Kerberos doesn't work if using IP addresses to connect to things, or from machines outside of a domain.
Probably one side of equation is that NTLM just works. For kerberos, you mostly have additional effort to manually add SPN. Moreover for load balanced Exchange, you must deal with alternate service account: https://docs.microsoft.com/en-us/exchange/architecture/clien...
Don't get me wrong - thats not a case where someone should choose NTLM over more secure Kerberos. Just that we should note Kerberos should be configured appropriately.