We are having code reviews now, but we haven't gone back and reviewed all the "legacy code". The problem is that a "legacy code review" would cut into our new projects, and the owner feels that we need to deliver these new projects for us to stay in business.
Been there, done that. :=(
Actually, ten or fifteen years ago, I was the programmer behind a complete rewrite of what I guess you'd call a "core component". Took a really crufty program, reduced it to essentials, and rewrote from scratch.
I suppose there are people who turn their noses up at such projects, but except for the "drop everything, we've got to do this" three month interruption (which, after all, can't have been that important since I don't remember much about it), it was a pretty interesting and rewarding project.
Alas, since then I've met/encountered a lot of code that could have used the same treatment, but never got it.