Which in turn means that important systems become frozen in time because upgrade attempts become boondoggles that can't meet requirements until they're so far over budget they get canceled, or never attempted.
One of the major problems that should be fixed immediately is that the government pays for code to be written but then doesn't own it, which makes them dependent on the contractor for maintenance. Instead they should be using open source software and, when custom code is necessary, requiring it to be released into the public domain, both for the benefit of the public (who might then be able to submit improvements to the code they're required to use!) and so that maintenance can be done by someone other than the original contractor.
The obvious downside to this is that hardening code becomes a potential large amount of effort/overhead that could normally be concealed behind binaries and proprietary code.
This is not a downside, it's a benefit.
Suppose an adversarial country eventually gets access to the proprietary code. Do you want members of the public to have found and patched any obvious vulnerabilities before this point? Yes you do.
The first proposal to break out the regulation of air traffic control with the provision of the air traffic control was done by the Clinton administration. Support since then has been bipartisan and opposition has also been from members of both parties for various reasons. (I read somewhere that one of the biggest long time opponents of breaking out the air traffic control has been the associations of owners of private jets as they currently pay about 1% of the cost of ATC, but are closer to 10% of the flights in major airports. In reality, owners of private jets can likely afford to pay a more proportional percentage of the costs they impose on the system.)