I've integrated with production APIs that tell the client to encrypt sensitive data using an IV consisting of 16 null bytes.

Some people just follow a spec and don't stop to think what that spec is supposed to accomplish.