It is not a zero-day if it has been fixed in a newer OS version. I would say, the main risk here are known vulnerabilities, like, bug in a system library which

It is not a zero-day if it has been fixed in a newer OS version. I would say, the main risk here are known vulnerabilities, like, bug in a system library which does image rendering, font rendering etc. Targeting known CVE for old (no longer updated) MacOS versions might actually be quite good targeted attack: probably a bunch of users of such computers are technical folks with access to production servers, cloud credentials etc.