I would buy the "updates are important because security" line of reasoning if software developers would bother to release security-only patches to old software, but most don't. Unfortunately, you need to take the bad (UI re-designs, unwanted features, changed file formats) with the good (securest fixes), so I unfortunately often decide to keep the old, slightly more vulnerable software.