There's also an assumption that the reason for it existing is still valid and necessary. MANY TIMES that's not the case. Without reviewing if things are still necessary, you're needlessly supporting stuff that is a net negative (and often leaves a wider security attack surface).
I recently looked at some old code I wrote in 2005, and modified slightly until about 2012. There's all sorts of mess in there, to support IE5 (not even IE6 which was the bane of anyone working in the corporate environment for far too long), flash based video, etc.
There's also an assumption that the reason for it existing is still valid and necessary. MANY TIMES that's not the case. Without reviewing if things are still necessary, you're needlessly supporting stuff that is a net negative (and often leaves a wider security attack surface).