The key point here is risk assessment. Your points are what should be factored into such a decision. Personally, I would seek to upgrade out of such old software, and I think it is somewhat healthy that we eventually make operating vulnerable systems cost-ineffective. But you also have to factor in a lot of other considerations. Some people are somewhat forced to live with the risk of a software vulnerability because there are other parts of the infrastructure you cannot upgrade. So you do your best to wall off the rest of the world and keep using the old system. It isn't ideologically sound. It isn't a good viable long-term solution. But at times, the survival of a company requires you to gamble with the risk.
Another observation is that to upgrade out of old software, you need to create an upgrade path that is viable. Since you are somewhat left behind, there are reasons for building some stepping stones along the way, perhaps not just tossing a hail-mary to the newest versions in the hope it fixes everything. Exploring these options might make it easier to handle the situation and slowly move away from a platform you don't want to be part of anymore. You strike the system and listen for where there is a resonance, you can use to lift yourself out of the misery.