In my experience the majority of enterprise service applications and smaller few-purpose systems are build following 1.

We’ve have an ASP Web Forms food ordering system that’s basically four forms and a simple CRUD admin system page that’s been running flawless for half a decade. It’s only needed upgrades to its .NET system as we moved up the TLS version ladder, and it has thousands of daily users. There are no tests, no real monitoring outside of “is it still up?” and no complaints.

Eventually we’ll have to clean up the database, eventually. But chances are someone will have build something new by then.