The main sites of large companies typically deploy WAFs, CDNs to hide real IPs, and dedicated security teams for continuous monitoring, and common vulnerabilities have been repeatedly audited and removed, making exploitation highly difficult.