Comment by peterwwillis

Many, many, many systems (like CDNs, or high-profile financial firms) depend mostly on IP whitelisting for their public-facing origin security. Whenever there's "partners" or "3rd parties" that need access to some service but they want to generally keep people from the internet off it, they just get lazy and IP whitelist instead of creating a VPN like they should. There's probably tens of thousands of organizations with setups like this.