Old crypto profiles often can't be removed because there's still ancient hardware that needs to be interacted with. Exhibit A: the SSH server in my modem only speaks diffie-hellman-group1-sha1 and 3des-cbc.

So putting it in separate legacy modules, removing them from automatic negotiation and putting warnings on them is usually the best option.

> We can do so much better than “be less dumb”.

Yes. But in the end "we only had junior engineers working on this piece of infrastructure" would not fly for Boeing either.