I agree, provided the software isn't network reliant / accessible.

If the software were to explicitly depend on <vulnerable library> and moving to <patched library> broke it that would be the nail in the coffin for me / make me question whether I want to spend the effort maintaining the project.