That will be a valid rebuttal when ten million shitty shared hosts are no longer on 5.x - and probably an out of date 5.x at that.
Something like:
The only secure PHP is version x.x or newer.> Given how much has been deprecated/removed since 5.2, would you care to list some that remain?
For the version coming out at the end of the year, what is still insecure that leads you to believe "there is not an $x where that a statement is true"?
7.x is better than 5.x but not GOOD ENOUGH.
What would make it good enough? Be specific.