Since this is a .net core project, I am a little puzzled as to why they didn't use the .net AES-GCM classes. It's part of .net core 3.1. There should be no reason to use AES-CBC mode in a newer application.
"Explanations exist; they have existed for all time; there is always a well-known solution to every human problem—neat, plausible, and wrong." -- H. L. Mencken I am not saying that the ideas you have listed are not without merit, however to say they will fix the 21 Century is a bit over reaching.