Unless a system can be proven safe (within whatever the limitations of that proof are) , it is by definition not proven safe. If it can - and most importantly,

Unless a system can be proven safe (within whatever the limitations of that proof are) , it is by definition not proven safe. If it can - and most importantly, is - tested for security issues (which are not the same as functionality, though there may be overlap), then some amount of confidence in its safety can be assessed, but it cannot properly be said to be declared as safe simply because of age. Hand waving and saying that uncompromised, at least as is known, code is known safe is simply wrong. Such code is simply not known as unsafe. Conflating the two as equivalent is not good engineering, but it is all too frequently a business case of unknown risk acceptance.