That ship sailed over a decade ago.

Arguing that a buffer flow, etc. is only theoretical unless you can show an exploit is nonsense at this point.

It makes it less likely that an attacker has right this second found and begin using an exploit. As you say, the ship has sailed over a decade ago; your stack will have unpatched CVEs, no matter how cautious you are or how hard you work. The most important parameter that remains available is which patches require which degree of expedited rollout.