Yeah, they can track and profile the old os, and feed the data to the risk models.

It's not about user security.