The mistake here is that assuming things will forever remain the same and thus you don’t need to update your software, when security enhancements require it.