If a PE vulture keeps a company with marginal profitability alive, there is absolutely no way they're devoting any kind type of human capital to proper maintenance.

It's likely running on the original infrastructure from acquisition, is full of EOL dependencies, and likely wasn't well-secured to begin with even before the takeover.

Any changes to regulatory requirements are also likely ignored. The EULA is probably full of all sorts of falsehoods about how they maintain the site. ("We use commercially standard methods to secure and blah blah blah ...")

Keeping these kinds of zombie sites online is not a win-win situation.