It is true that it's still under support, however that page you linked is almost 100% about migrating away from FTA to kiteworks which is their new platform. I would be relatively shocked if it's actually revenue generating in 2021, unless they charge for support. At my company at least, anyone calling about a product on that page would be very clearly told we're not selling new contracts for that, would you like to hear about NewShinyThing instead.

That said a SQL Injection vulnerability in a 20 year old product definitely raises certain, questions.

Yes, if they have a known vulnerability in the wild in a currently-supported product, the rest is just details.

Tangentially, I wonder: has anyone built a friendly browse/search interface for all-time CVE data [0]? This makes me curious about what the history of SQL injection vulnerability discovery looks like.

0: https://cve.mitre.org/data/downloads/index.html