There are still some legacy tcodes used as parameters.
SE38 makes very little sense as it calls AUTHORITY_CHECK_TCODE on itself in the submitted program. SA38 is still in the easy access menu navigation and titled "ABAP reporting" so is harder to replace with alternatives as you dont know how many are actually using it and the navigation path.
But it can be done and works fine if you can work out who might be authorized for it and compare it to who is actually using it - then you know who you need to provide a better alternative for than using SA38 with backspace to find the favourites from memory IDs.
Cheers,
Julius