Yes. A common answer to "we depend on this application that only runs on Windows Server 2003" is "well, use Citrix jumphosts to access the insecure app running

Yes. A common answer to "we depend on this application that only runs on Windows Server 2003" is "well, use Citrix jumphosts to access the insecure app running on the insecure server and you can call the risk mitigated!"