> leaves no path to incrementally update

Sure it does? Or do I not understand? It pushes the work to the application, not the language.

And it works fine on rails. If you want to stay on an EOL rails, you're on your own, or you can buy ongoing security backports from at least 2 (that I know of, maybe more) vendors. LTS lives roughly 2 years and then you either upgrade or deal with eol yourself.