I'm self-hosting a couple of services that stopped receiving updates (including security updates) about 10 years ago. They still serve my needs perfectly well. They're hidden behind HTTP authentication (with HTTPS) so the internet noise ("AI" shit, web scrapers, shodan, script kiddies) doesn't even know they exist.