"We've decided it's ok to have a dependency on a software component that's no longer supported. We believe security bugs won't be an issue because of [XYZ]"

I would not want to be the engineer that has to explain/defend this position.