But it was broke, security support ended 3 years ago.

I wouldn't use a condom that broke 3 years ago.

Unfortunately, these days it's arguably safer to run an unsupported version of Windows. Microsoft is obsessed with putting adware and features that put your data at risk into the OS, so it's not clearly the best choice to stay current any more.

In practice this doesn't affect the overwhelming majority of people as they're either not going to be compromised (the most likely case) or, in the tiny chance they're compromised, they're not going to notice (in which case from their perspective it still "isn't broken").

It isn't like this is the original WinXP during the era where computers connected directly to the open internet and caught viruses just by existing, making computers groan and being very visible that something was wrong. Pretty much everyone is connected via a firewall and on top of that Windows has improved its security considerably over the years. And there are still security updates for browsers (the main vector for malware by far) that support Win8.x (e.g. Firefox ESR will be supporting Win8.x until next year and people have made Win7 and Win8 compatible builds for modern Chromium).

So it isn't surprising that for all intents and purposes it isn't broken, especially when the alternative is having to change to something that feels like downgrade in terms of UX. From a user's perspective it is a choice between the unlikely potential of something invisible perhaps happening (getting compromised) versus the absolute certainty of something very visible happening (having to get used to a worse UX). Considering Windows still tie security updates with everything else, it isn't surprising that people judge based on what they perceive the most.

Of course the best solution would be to switch to an OS where such choices are not necessary in the first place. I've been using Window Maker since early 2000s and the UI has remained the same since 1997 when WM was first made, aside from the occasional theme change (which is done only whenever i personally feel like it, i.e. is not forced on me) while at the same time i'm using the latest Linux kernel, C library, drivers, etc with all security fixes. I do not have any choice between having security fixes or using a GUI that i am comfortable with - i get to have both.

Software is not "broken" just because it doesn't get updated with new spyware and adware every week. This is a misconception spread by companies like Microsoft.

Support ended in January 2023...