This is why banks still use COBOL and Fortran.
- they could continue to maintain python2
- they could move to a non-python platform
- they could go out of business
- they could hold out for Python4 (Python3 was only 8 years after Python2)
...But if an individual or organization does not find the python 3 updates and ecosystem a compelling upgrade over 2, “don’t update until the next big change” is definitely one option.
Python core team will eventually cease support 2.x support at some point[1], so the ones who uses 2.x will be on their own. Will the cost of self-patching python 2.x lower than rewrite the software application you developed on 2.x? Well, that's on them to decide. After 2.x being officially deprecated, what's the point of having a Async HTTP/2 client working (mostly back-porting features that's already on 3k) on 2.x?
Once again, the point is that software will continue working beyond that deprecation event.
As you said, the cost/benefit analysis of a rewrite isn't always in favor of a rewrite at that point in time. So what must follow is that there will be Python 2 software out in the wild for some time regardless of support. What other possibility is there?
Yes, python 2.x code will work - but in the event major CVEs for a piece of software stack that's deprecated, you are left to no choice but to fix on your own. Those sometime are by no means no small feat! And mind you this is an ongoing battle to patch up security holes.
(Google, for one, still uses 2. As does Dropbox. And both companies had Guido Van Rossum working for them at some point).