As long as you are willing to spend some of that budget continuously patching and maintaining the old 2.x interpreter to address security vulns as they are discovered (IF they are discovered), sure. No need to upgrade!