I wonder what the active device threshold is for them to make the decision to patch an operating system from a decade ago.
Probably recent active exploitation