It’s a liability. The problem with security measures is that there is no immediate reward, but a few years down the line and you get ransomware’d you would want to have replaced legacy systems with modernised software and hardware. You need to weigh the cost of modernisation versus getting embarrassingly pwned.