To a certain extent yes, they are SOL. Their device is no longer supported and will continue to be vulnerable to existing exploits indefinitely. They are at risk similar to people who still run Windows XP.
That said, this issues is a red herring in the context of the article. We are talking about not installing a maintenance release.
Unfortunately newer major versions may impact performance, but as far as I am concerned, knowingly refusing to patch is irresponsible while participating on a shared network.
irresponsible to themselves maybe, i could care less if they are patched or not as long as I keep my security up to date.
How many folks are using iOS versions 9 and below? Are we seeing major security issues with that?