One also needs to consider along with the contracting out of the design, closed systems start being installed where LT/MR/LU/TfL don't have access and knowledge of what's installed on the units.
So when you have for example a control relay or control relay box, you know what all the inputs and outputs are, and can therefore replicate the function and form with a more modern piece of equipment without too much effort (usually!).
Compare that with chunks of electronics where the communications network between them is sold as a system, and particularly before the more contemporary network definitions and standards have come in such as MVB (Multi-Vehicle Bus) WTB (Wired Train Bus) and ECN (Ethernet Communications Network). Combined with the drive to have integrated and connected systems within the cabs of trains, and the drive towards reduced harnessing costs, meaning you need to have a single (or two) combined ECN or MVB network. Now since this is only being really used in the last 10 years or so, one hopes these will be more maintainable as they're based around EN series standards, but thanks to the ever increasing complexity of software and integration into single networks, I very much doubt it.
Where as if you look at 2000s designed units, where multi-vendor systems were defined, you have say, 9 sets of communications networks based on various standards of the last 10 years when designed, not the best thing. But as they're separate systems, you can replace one system at a time, and as they're multi-vendor, the interfaces between the systems are very well defined in ICD type documents. eg. a CCTV system that passes images into a cab, but is a separate vendor from the cab monitor system and OPO CCTV, the signals between the equipment are defined as something like CVBS signals, which as very easy to replicate in a replacement system module. That isn't something I've been seeing more recently, unless, the asset custodian takes ownership of the digital networks on the asset, which most asset custodians simply don't have the competency to manage, even if they wanted to (which due to 'min cost' pressures, they don't want to anyway.)
EDIT: OPO - One Person Operation
(Caught the undefined non-standard initialism).