There's a difference in security issues due to programming bug vs insecure design.
If an application was created without security in mind in worst case it might require complete rewrite. In other cases it might be a whack-a-mole game.
For example compare ssh vs application that simply opens port and starts bash as root. You can use both to control your server, but if you want to add security it would be a lot of work (you could incrementally add authentication, encryption, maybe restrict user what s/he can do but there will be million and one ways to escape).
After fixing one issue after another without seeing the end you'll realize it would be less work to just rewrite it from scratch with security in mind.
If an application was created without security in mind in worst case it might require complete rewrite. In other cases it might be a whack-a-mole game.
For example compare ssh vs application that simply opens port and starts bash as root. You can use both to control your server, but if you want to add security it would be a lot of work (you could incrementally add authentication, encryption, maybe restrict user what s/he can do but there will be million and one ways to escape).
After fixing one issue after another without seeing the end you'll realize it would be less work to just rewrite it from scratch with security in mind.
Security is not a feature, it is a process.