How exposed is your app, really?
The app may have been live for years. Different teams have shaped it over time. Some architectural decisions were made in a different commercial climate. It performs well most of the time and, from the outside, everything appears steady. Revenue flows. Users rely on it. Delivery continues.