You're using a version of the php software that is not receiving security updates.

While CentOS might be supporting 6.9 until 2020, that doesn't mean Redhat is going to be performing security updates on PHP. Ubuntu obviously is updated a bit faster than CentOS, however you still need to use PPAs to receive the latest versions of PHP.

> many, many developers and site admins for various strong reasons are not in a position to do so.

I'm not convinced that this is a valid argument. If these versions of PHP were still supported, sure, but they are not and that is the real risk.

> Please consider the possibility that you do not understand the real world in which many, many developers work.

This is stand-offish and rude.