Most software used not to be connected to the outside world. It wasn't vulnerable at all unless the attacker already had control of the host.
In the thirty years I spent developing software I spent hardly any time on anything that was accessible through the network and I'm confident that I'm not the only one. The embedded control software that I wrote for 6502s would still work today and would be completely invulnerable to attacks other than from someone standing right in front of the machine pushing buttons.
Of course now that everything has to be networked so that your fridge can advertise special offers to you the situation is changing for the worse.
In the thirty years I spent developing software I spent hardly any time on anything that was accessible through the network and I'm confident that I'm not the only one. The embedded control software that I wrote for 6502s would still work today and would be completely invulnerable to attacks other than from someone standing right in front of the machine pushing buttons.
Of course now that everything has to be networked so that your fridge can advertise special offers to you the situation is changing for the worse.