I’m way more often than not on the side of refactoring but there’s risks on both ends with a mission-critical service like this. Neither side is zero risk, the choice is about which option will result in fewer and less severe outages.

Sure, the problem is most people can only see the risks of changing code. They're completely blind to the risks of not changing it.