Have you ever read the man-page for telnet? On my Debian system the last two lines read:
BUGS
The source code is not comprehensible.
That's probably one of the dividing lines. There are many programs that have "bad" source code, but which are still essential.
Another measure of "badness" could be how extensible, or not a program might be. Or even how many security-holes. With regard to security holes some projects such as Wordpress or Wireshark crop up too often.
But honestly? Most of the badly written programs aren't so bad, if you ignore a couple of outliers. If the benefits outweigh the drawbacks then the software leaves the world a better place.
Another measure of "badness" could be how extensible, or not a program might be. Or even how many security-holes. With regard to security holes some projects such as Wordpress or Wireshark crop up too often.
But honestly? Most of the badly written programs aren't so bad, if you ignore a couple of outliers. If the benefits outweigh the drawbacks then the software leaves the world a better place.