I'd say they are not very risk averse if they are still using IE6. In fact, I'd say they are living on the edge. I hope the CTO has a really nice golden parachute because they will need it when (and not if) the proverbial poop hits the proverbial fan.

I believe those are closed systems not connected to the internet. It still would be better to upgrade them (for easier access to spare parts, knowledge, etc).

Otherwise they end up like this French airport which was shut down just few weeks ago because their Windows 3.1 failed.

https://news.ycombinator.com/item?id=10559687

Maybe there should be a much more stripped down thing like the web with a much smaller attack surface or need for new features, so updates will only be occasional security updates.

In China?

If you look at the numbers and include China they're quite bleak. If you exclude China it doesn't seem quite so bad.

But China has a massive Windows XP piracy problem that isn't going away.

How many have XP/Server 2003 custom support?