Older releases aren't the problem as long as they're maintained, which RH devs are good doing so.

Taking a 4+ year old release and not applying any patches even if upstream did their due diligence with informing users about a lot of fixed stuff and then shipping that by default is rather unacceptable by the OS distro vendor though.