It wasn't really any better when Apple killed things off. For years afterwards I was running into devices that had embedded Java applets for configuration over the Web that no longer worked. Sometimes I'd run into an academic's personal web page that had examples that used Flash or Java and no longer ran for the same reason. There was a lot of useful legacy code that got broken overnight when Apple led and others followed in killing off these kinds of plugins.

For all the claims about security problems - and there were many and the complaints were valid - people seem a bit too willing to overlook the much greater attack surface of modern browsers that still incorporate similar flexibility and functionality but through other protocols and native Web standards now instead. For better or worse today's "evergreen" browsers roll out new functionality more quickly than before but their most important innovation was introducing frequent automatic security updates to a general non-technical audience at a time when that certainly wasn't the default for most desktop software. Take a look at how many significant security issues get fixed in any of the major browser on each update cycle and you can see that even today this is still far from a solved problem.