Every skipped website update is a loan someone else decides when to call
The site still works. Why spend $8,000 on an update nobody will notice?
It feels like a reasonable call. Then five years go by. The site runs on software its maker stopped patching, the plugin that takes payments belongs to a developer who moved on, and the agency that built it holds the only admin login.
There's a reason it's called tech debt. Every skipped update was a loan, and the interest kept running whether anyone looked at it or not.
Unpatched software is one of the most common ways attackers get in. Often the fix had been out for months. Nobody had to be clever, only patient.
The part that stings is that you do not pick when the bill comes due. Someone scanning the internet for that exact old version picks it. Then the $8,000 you saved turns into customer card numbers in someone else's hands, a letter to every customer, a forensics firm billing by the hour, and a site that stays offline until someone can prove it is clean.
Paying it down on your own schedule is a budget line. Paying it on theirs is a crisis with your name on it.
Before approving another "leave it as is" year, ask whoever runs the site what it is running on and when it was last patched.