Its quite possible that for systems that old, there are no updates even available. Its also possible the systems have no route to the internet, which while not making them immune from compromise, certainly makes it more difficult.

Security patches don't necessarily affect uptime. For example, patching and replacing e.g. libc on a live system is entirely possible, even though it's not the standard procedure.