From experience I'd say there doesn't tend to be a great deal of documentation, or up-to-date documentation anyway, on a large monolith application.

Good software engineers are not necessarily good writers, so even when there is documentation it's not always helpful either. Especially to completely new people in a project without background information. For security related work, how much background can you assume? How in-depth does the documentation have to be? etc etc..

Documentation, even when it's there, doesn't always fix this.