If you work on any non-msft stack I know of, you're constantly updating code for any, sometimes even minor version upgrade.
https://blog.pcisecuritystandards.org/migrating-from-ssl-and...
(That's the PCI announcement in 2015 that despite everyone knowing about problems with TLS1.0, they would continue to allow it through 2018 because of all the companies who deferred their technical debt in the manner you seem to be advocating.)
I know is hard to believe it's that simple, but it is.
1. Know what to do.
2. Have approval to do it.
3. Do it.
... which is to say, maintenance. The fact that maintenance is simple and/or easy doesn't mean it happens by itself.
Yes, there will always be _some_ maintenance. The point is it should be as simple and easy as possible.
Someone isn't getting the point, and I don't think I can make it any clearer.
If we made things harder to upgrade would that encourage more people to upgrade?
You are right; but in my experience those ASP applications also had security holes (CSRF etc) that were never patched. They ultimately either became botnets or faded away when the corp simply faded away.
A business that can't afford to pay for cleaning up its business applications is likely to be unable to pay for general upkeep as well. It is simply past the point of being a viable business and is either in limbo or in the grave!
See "maintenance free" approach to software as canary in the coal-mine and run away as fast as possible.