And if you dont get hacked you risk that your site is just offline due to something breaking down (maybe the db needs to be restarted, maybe the webhost changed php version etc). I got a couple of static sites and it so nice to know they are always up and never need to be fixed. My dynamic sites on the other hand needs to have alerts to check if they go down.
Outdated PHP is a big thing. So many times I've pulled a php file from an old server and it fails to run on the new because some methods were deprecated twenty-dickety-two. Which isn't a criticism of the language, just how things go. You either have to rewrite it to modern or run an unsupported version of PHP.
