What if you managed a non-EOL OS, like Windows 10, but you had inside information that there were multiple active ongoing exploits? You might say you would disconnect them from the internet. But I think it comes down to blame. No one would blame you if Win10 computers were connected to the internet and were exploited. But people _would_ blame you if they were XP. I think this pretty much explains how people think about these choices.