Apart from requiring security fixes, they also sometimes block changes and newer features. At that point, the maintainers might have to choose between breaking the obsolete module or shelfing the feature/fix.
Deprecations are the way to indicate that support for the module will be eventually dropped. There is no reason to leave those modules there if they cannot be relied on.
Because supposedly people will report bugs for them and someone will need to fix them.
“Sorry, we don't fix bugs in deprecated code. Closed.”
“Deprecated” usually implies intent to remove. Regardless, even dealing with such rejections is a support burden. And security vulnerabilities will tend to be fixed, even in deprecated code.