TLS 1.2 is known to have a lot of problems that wouldn't in practice be fixed by extensions except in the sense that TLS 1.3, for compatibility reasons, pretends to be a single "extension" to TLS 1.2 which I've characterized as "Fly-casual-this-is-TLS-1.3" and is not in reality an extension at all.
Among the worst problems is that both cheap "We'll talk again soon" key agreement avoidance optimisations in TLS 1.2 are effectively security holes by design. However generally the problem in SSL and TLS up to 1.2 was that they're designed by software engineers who know some cryptography and then some real cryptographers are brought in at the end to check it works. Like having the civil engineer give your bridge design a once over after some non-engineers have made the plans it's just too late to do a proper job. "This bridge will definitely collapse and kill everyone" is avoidable, but "I dunno, this seems like a bad idea, I wouldn't do it that way" just gets ignored as too late.
TLS 1.3 is the first version where cryptographers had actually proved it works before the protocol was set in stone. Now, the proof has a small misunderstanding (called the "Selfie" attack, it's not relevant to a web browser but people doing low-level peer-to-peer type stuff need to understand it before using TLS at all) but having it at all was a huge difference.
Among the worst problems is that both cheap "We'll talk again soon" key agreement avoidance optimisations in TLS 1.2 are effectively security holes by design. However generally the problem in SSL and TLS up to 1.2 was that they're designed by software engineers who know some cryptography and then some real cryptographers are brought in at the end to check it works. Like having the civil engineer give your bridge design a once over after some non-engineers have made the plans it's just too late to do a proper job. "This bridge will definitely collapse and kill everyone" is avoidable, but "I dunno, this seems like a bad idea, I wouldn't do it that way" just gets ignored as too late.
TLS 1.3 is the first version where cryptographers had actually proved it works before the protocol was set in stone. Now, the proof has a small misunderstanding (called the "Selfie" attack, it's not relevant to a web browser but people doing low-level peer-to-peer type stuff need to understand it before using TLS at all) but having it at all was a huge difference.