While obviously not on this scale, I see legacy systems and applications on a significant number of the engagements I perform. The risk isn't even that they're disabled and that someone might re-enable them later on, it's that they're left online just in case some weird piece of legacy information needs to be retrieved at some point in the future. It's kind of sad, but after awhile, you just get desensitized to it.