It is (or was) the default mode, and, unlike CTR, you don't need anything more than a key to use it; no nonces, no IVs, no parameters. Put yourself in the shoes of someone who doesn't know much about cryptography, and it's a natural choice.
But then I'd have to say... why is a company doing a secure password saver not employing anyone who knows the very basics of how to use cryptography? :)
Because that isn't important for success. Perception is reality. Very few people can tell the difference between good and bad crypto work. So instead of wasting money on that, invest it into something that is understood by more of your customers. It's a sad reality.