Decades-Old Code Is Putting Millions of Critical Devices at Risk