Developers tend to install a lot of little things (without any research into the trustworthiness of those things), that then never get patched and lead to an ungodly pile of detected vulnerabilities to clean up.