I suspect it's largely very similar, with low/un-supported systems just running for years. The real risk is how connected these systems are. Are they isolated

I suspect it's largely very similar, with low/un-supported systems just running for years. The real risk is how connected these systems are. Are they isolated to specific VLan/segment traffic in addition to login and tighter ownership process? In the end, I find that most of the stuff that I've done with MS-SQL, especially in single-server environments is just as easy or better with PostgreSQL. I think the UX for replication scenarios, versioning and a few other bits are much better with MS-SQL, but you will pay (significantly) for those features in practice. I'm not sure if/when some of the more Enterprise features will be closer to in the box with PostgreSQL, but I have doubts... there are great underlying features, but it's not the same.