I‘ve had stuff break because of required kernel updates, software that needed to be patched, hardware breaking and no exact substitute being available, database sizes crossing critical thresholds, … - it‘s definitely less risky to run something that is well understood and no longer getting substantial amounts of updates, but every complex system has known and unknown deficiencies that are just a butterfly’s wingbeat away from being triggered. As long as you‘re on the happy path, everything will look fine. But if something pushes slightly and moves you to the unhappy path, you can find yourself very quickly in a position where you need someone with a deep understanding of some obscure component of the system that is misbehaving - and that someone is unlikely to be the infrastructure team.