Why is everyone still using raw subprocess.call in 2026?

I keep seeing production scripts using subprocess.call() with shell=True for things that should be pathlib + subprocess.run() at this point. What's the actual barrier? Legacy codebases, lack of code review, or just inertia? In our team we enforced a lint rule that bans shell=True except for interactive debugging. Cut our injection surface to near zero and made error handling actually readable. Jurisdiction: AGNOSTIC