I don’t know much about security stuff, but I feel like older systems falling from popularity are not the usual targets of people who write them, and encountering one using an outdated OS would probably mean nothing since exploits they want to abuse aren’t there yet.

The issues that are going to be the problem eventually are vulnerabilities that affect both new and old versions of Windows. The new versions will get the patch, but 7 won’t. And it still might be worth exploiting to hit the machines with the newer version that don’t update quickly or at all.