I built a relatively simple system over 10 years ago that ran on PHP and MySQL. Over the years, the company I built the product for has come back to me to upgrade PHP and MySQL after a security scan. The problem is the software was build for PHP 5.4, and they want it running on the latest (7.4). It doesn't.

I managed to get it running on the latest security release of 7.1 with a few days of work (I had to make code changes in the framework I used that weren't supported in PHP 7 anymore). If they want future security upgrades, it's going to require a even more significant rewrite of the software because it relies on old PHP behaviours that have been removed in recent releases.

So, I completely understand why 20 year old systems would still rely on floppy disks.