I see this statement all the time. And it's frequently a universally-applied authoritative statement like this comment. I think it's incorrect and short-sighted

I see this statement all the time. And it's frequently a universally-applied authoritative statement like this comment. I think it's incorrect and short-sighted to unilaterally decree things like this. Instead, I think the correct way to approach this is on a case-by-case basis that takes into consideration the function of the computer, the needs/priorities/legal obligations of the users, and importantly their risk tolerance and risk appetite. A security policy that is not in some way modulated by risk is a policy that does not account for the real-world complexity of its systems. There is an increased risk to using out-of-date software, but without knowing this person's risk tolerance or priorities, we are not in a good place to advise a security policy.