This is true if the software isn't being maintained. I rely on a few deprecated utilities that are stable in the very limited sense that they will likely never

This is true if the software isn't being maintained. I rely on a few deprecated utilities that are stable in the very limited sense that they will likely never break on their own in the current way they are being used. They doesn't mean they're not currently vulnerable. Systems are as stable as their most vulnerable components. I don't think that's a contentious notion at all.