For an application that is hosted by a legacy server version which cannot be patched, could a periodic security centric application code review prevent potential exploitable vulnerabilities to the application? Can an application security code review replace non patchable servers? Let's say codes related to sensitive data in an application. A code review cannot replace patching or address all exploits but it could mitigate some risks that is caused by poor coding practices. If a legacy server is non patchable, wouldn't a security centric code review address at least some exploits that stem from poor coding practices?
Security code review is a good idea, but it does not protect against unpatched software. For example, if your server uses Nginx, it could have been vulnerable in the past to CVE-2013-2028. It doesn't matter what application code is present, because the vulnerability is in the web server itself. The best way to fix this vulnerability is to patch the server. There may be other ways to mitigate the vulnerability, but patching is almost always the best solution.