It is not because of specific known vulnerabilities. It is because it is old legacy unmaintained code which is rarely used and which has a large attack surface.