The author isn't considering an alternative strategy, which is to address security issues in-place (i.e., without upgrading Django). This means keeping up on them and substantively addressing them through configuration or possibly custom code, but for something they want to freeze in time with respect to a platform, it's a reasonable choice.

Every time I've had security issues to address, there's almost always a short term fix (close a port, disable a particular eval method). In the cost/benefit analysis of maintaining a legacy app, it's a legitimate option to simply rely on those.