years back, i was in the tech support team for an open source package.
we sold support contracts to large enterprise/govt/military for that package.
shortly after i joined the company, a huge security hole was discovered and we tried to get customers onto the current supported branch. we found out that a non-trivial number of our customers were still using a 9 year old branch that had been deprecated at least 18 months before this due to a number of unfixable remotely exploitable root level vulnerabilities. scarier still, we found out that a .mil site was using 12+ year branch of the software that had been deprecated due to exploits over a decade before.
it taught me to never *not* expect some folks to run truly antiquated stuff *years* beyond the expiry date.
