People have big egos. I’ve been in similiar situations as OP where the owner/CTO wrote a lot of the legacy code and weren’t particularly receptive to criticism. No acknowledgement either when said criticism turned out to be a client facing vulnerability later on.