I don't know about Windows, but I've been running all kinds of outdated Linux (Debian mostly) and it never once caused a security problem.
Debian backports security patches.
Debian backports security patches.