Justifying the conversion of a legacy project, that's still being maintained, is very difficult since the conversion doesn't necessarily bring anything tangible, without refactoring, especially if you have fixed dependencies. And, until python 3.7, the conversion would just make everything slower. That's something you never want on your justification list.

There are many apps written in the old Python nobody is going to rewrite in Python 3 despite many people may need them occasionally. In many cases they can be used for decades as long as there is a compatible interpreter available - there are many contexts where security fixes are not really necessary.

There also are platforms where new Python is not and not going to be available, e.g. DOS.