I would argue that we don't really know what would have happened had the world not spent all the money on upgrading systems. It appears a very large number of them would have continued to work as expected and it isn't immediately clear if the ones that were replaced would have resulted in a catastrophe.
What they didn’t do, much, is write or blog about their work. A lot of fixes were to commercial or government systems running on commercial or government hardware. Publicly disclosing problems and fixes was not part of those cultures.
So it is very hard, today, for members of the public to go back and reconstruct the problems and solutions to “prove” that there were real issues. Which has led some people to believe, incorrectly, that there were not real issues.
Is that because we found and patched all the systems that would have actually had a problem? Maybe. I'm guessing it is because many of the things that were fixed, wouldn't have actually caused any signifiant problem--at least not at the scale that was being predicted.
But as you point out, if there were any systems that would have failed in a catastrophic way, those were evidently fixed.