It IS bespoke internal development, not for deployment outside of the facility.
The computers running the software exist only to run this software and have no business talking to the internet at all.
IT is provided by an external third party vendor who operate on an inflexible “best practices dogma”.