Sure, for those who could upgrade their servers in a day that's fine.

For some, it might be relevant to assess the actual risk of being exploited while you figure out how to upgrade the PHP 5.x (or 7.x whatever) stack. There are still important decisions to make when you're put into such a sucky situation: do you take the site down? do you rush the upgrade? (faster probably means more money and bugs) or is it feasible to just chill and upgrade the servers at the normal pace?

I'm glad I don't maintain anything related to PHP but sometimes you don't get to choose your circumstances.