On the other hand, maintaining obsolete code is very expensive (both in terms of time required to develop new features without breaking existing code, and also

On the other hand, maintaining obsolete code is very expensive (both in terms of time required to develop new features without breaking existing code, and also the architectural difficulties when you cannot refactor or clean things up), and you cannot simply tie developers to a chair and compel them to maintain projects in a fixed state forever. I would think that a prepackaged, heavily sandboxed VM with the appropriate configuration and software could be provided alongside the artefact of interest, much like using DosBox to play old games. This would be inconvenient, but in cases such as Flash it should not be possible to run the vulnerable software without being forced to acknowledge the inherent security risks (especially if the container interacts with the internet).