Old web apps rendered HTML on the server. You clicked "My Account." The server looked up your session, grabbed your data, and returned a page built just for you. You never touched an ID. The server handled everything. If the server was coded correctly, you only ever saw your data.
Modern apps use APIs. Your phone, your browser, your third-party integration — they all send requests with IDs. GET /api/users/8831/profile. The client picks the ID. The server just responds. Now the server has to actively verify every ID it receives — and most of the time, it doesn't.
Most APIs use sequential integer IDs — 1, 2, 3, 4. If your ID is 1042, order 1041 and 1043 almost certainly exist. An attacker doesn't need to guess. They just count. The data is practically labeled.
APIs are everywhere now. Every mobile app, every SaaS product, every connected device runs on APIs. BOLA is so common because the architecture that powers the modern internet creates this problem by default — and fixing it requires every developer to remember to add a check they weren't taught to add.