1 article on this topic.
A widely discussed developer comment on why full system rewrites rarely pay off applies just as sharply to security debt, where the temptation to 'rebuild it securely' often leaves the vulnerable original running for years.