Why this lands on the owner, not the developer
An unsupported store is a risk you carry, not a bug your team can fix. Three things follow from it.
First, security. Every flaw disclosed after support ends stays open on your version. Attackers read the same bulletins you do.
Second, payments. Card-scheme and PCI expectations assume you run software that still receives security patches. If you take cards on an unsupported release, ask your payment provider or assessor how they view it before they ask you.
Third, everything else gets harder. Extensions and PHP versions move on, and a store several releases behind turns a routine upgrade into a project. The longer you wait, the bigger the jump, which is why ongoing Magento maintenance is cheaper than periodic rescue.
One more practical point. Version numbers in the admin often carry a patch suffix, such as a "-p" followed by a number. That suffix tells you how current you are within a release line, but it does not move you to a newer line. A store can be fully patched and still sit on a release whose support is over.