v1 predates the authentication system introduced in v2. An attacker calls the same endpoint on v1 without authentication and gets the same data. The v2 auth check is irrelevant — they never went through v2.

Old API versions may expose data that was intentionally removed from newer versions — like Facebook v1’s friends permission. The data is still in the database; the old API version still has the query; the access control was only removed from v2.

Bulk export, mass deletion, admin operations, or data modification features that were removed or restricted in v2 may still be available in v1. An attacker calls v1 to perform operations that v2 would refuse.

Staging environments often run identical code to production but with debug mode on, verbose errors, and relaxed auth. An attacker who finds staging gets a map of the production API: its endpoints, data structures, error behavior, and internal architecture.

Security patches applied to v2 leave v1 permanently vulnerable. If a critical vulnerability like SQL injection or SSRF existed in v1 and was patched in v2, the v1 endpoint is a permanent exploit entry point — forever, until v1 is decommissioned.