Except historically, this hasn't really come to fruition. The hackers putting in the effort to write malware and trojans usually have little interest in trying to find an unpatched vulnerability in old software or operating systems that have long gone out of support. The returns for their work are just too little, with such a small percentage of people still running them.
You have to figure, when something has been on the market with security patches still coming out for it for 6 or 7 years straight, it's a fairly secure product by the end of all of that.
The negligence comes in, IMO, more in lost productivity and lack of compatibility with other people your employees need to interact with online. At some point, it doesn't make sense to try to save a few bucks by not buying the current version of business software your people are paid multiple tens of thousands of dollars per person, per year to use. Look how many headaches it causes just from people emailing newer versions of Word or Excel documents that you can't open if you're still on an older version?