I am pretty sure Red Hat, IBM, and probably other enterprisey type companies backport security patches for Java 8.

Tons of folks in financial IT are on 8 - it is pretty stable and very common target for most of the libraries being used.

We're still on 8 at <bank>