I have a 4s on 9.3.5 my son used. As long as you have iOS 7 or above Facetime will work. The certfiicate under iOS 6 is expired and Apple did not renew it on purpose so people would update.
I also have an iPhone 5 on 10.3.1. Works just fine.
Do you think Apple would react to a "WannaCry" like attack on its older OS's in the future? Like Microsoft did release a one-time emergency patch for XP machines which were supposed to be EOL'd?