If anyone I oversee actively decides to not patch and maintain a system within an enterprise network for any reason, they will find themselves back on helpdesk doing password resets until they learn better. Pentesters / hackers love using setups like you suggest as easy targets to provide them with perstitant backdoors.

3 and 5 years are the common life cycle's enterprise IT use when discussing any existing implementation or any new system design. These are not pulled from nowhere.