Are the "security updates" really required? Let's say you are running Ubuntu 20 with nginx simply hosting some static websites, and you let it run for 5 years

Are the "security updates" really required? Let's say you are running Ubuntu 20 with nginx simply hosting some static websites, and you let it run for 5 years without any updates. Are there vulnerabilities so big found with the OS or very popular software (like nginx) that they could compromise your server and give root access?