You don't need to know Blizzard's current infrastructure intimately to make some inference about the effort involved here.

For example, Vanilla's server code is from 2006. That's 10 years ago. It's an objective fact that security standards from 10 years ago have been broken, exploited, deprecated, and are currently considered unsafe and insecure today. By that line of thinking, it's an objective fact that Blizzard would need to do some leg work in hosting a Vanilla server to ensure that the security was modern even if nothing else was changed.

Combining the fact that they must update the security on the server, and the fact that the Vanilla code is so spaghetti that they can't even increase the default backpack size, we have no reason to believe that the server code wasn't as equally spaghetti. Thus we can infer that updating the security to be modern is potentially a gargantuan task that will have widespread ramifications.

Then there's the matter of the client. We know for a fact that Blizzard used .MPQs for Vanilla and their new file storage for Warlords. Going off of this, they have two options: they can either update the Vanilla .MPQs to the Warlords file systems, or they can store both copies of the files on the users hard drive. If they have one client, this means that even if you have absolutely no interest in Legacy servers you'll be forced to store the data on your hard drive.

We also know for a fact that this means that when Legacy is getting a patch, Retail will also need to download that patch. The reverse is true. That means that people who have no interest in Legacy servers are now forced to download bigger patches (potentially with an ISP data cap), forced to use more space on their hard drive, and forced to be unable to play WOW while Legacy servers are patched.

The alternative is to have two copies of the WoW client laying around. This is a huge no-no in software development. You never want to fork your codebase and attempt to maintain both at the same time. Every single change you make to one for non-gameplay reasons (security, network updates, Warden, etc.) needs to now be implemented twice.

That's twice the development, twice the debugging, twice the documentation, twice the chance there's a security hole not being plugged.

This is all objective fact. There's nothing subjective about the above process. It's standard engineering.