(I got the sarcasm)
Modern software isn't fire and forget. Developers who have grown up around security exploits understand that. Higher management and FORTRAN77 programmers don't. To them it's developer busywork.
The real judgement being made is money and resources.
[citation needed]
I have encountered exactly zero bugs in Python 2 in production. Code doesn’t magically stop working
Your locally running, toy projects will continue to run under Python 2 indefinitely. Large [esp network-facing] projects will start to fall apart.
I predict that Python 2.7 will continue being supported by some capable organization for at least the next 10 years. As a lower bound, Red Hat has promised to continue supporting it for RHEL 8 customers until at least 2024.
Many deployments rely on more than a supported cpython binary. External packages and the rest of the server stack. The Python community has largely dropped Python 2 support. If you don't need that, great. If you do... Then what?
You could pay people to support your entire stack. You could upgrade. It's that choice that makes Python 2 dead.
You can still run Windows 2000. Doesn't mean it's not dead.
Unnecessary changes and the overall fragility of "modern" software takes money and other resources away from dealing with actual security issues.
There's no reason why things like a library of geospatial calculations (distance between two lat/lon pairs, etc) should need constant maintenance. They could be written once and then used for decades.
That's the biggest problem with the "old" ways of doing things, you simply don't know where you're vulnerable. Refusing to allocate resources to revisit old code, only to add new features is a recipe for disaster.
Upgrading to Python 3 does not fix this alone, but ignoring it, and the other dependencies that you might have, and that old Redhat 7.1 box running Linux 2.4 that's all probably fine, it's just card processing, right? Nothing else has changed.
The "modern" ethos is testing everything all the time. Yeah, it's a shed-load of extra stuff if it's new to your project, but it's only codifying things that you should be doing anyway, even if only seasonally.
Yes, there is occasional fragility, but that's more than offset —at least in my network-facing world— by the constant stream of security fixes across my stack.
Sticking your head in the sand won't protect you.
I have code bases that will be forever stuck on 2, because they're not active projects and are archival only.
https://www.python.org/dev/peps/pep-0373/
Edit: I can't find a way to delete this, but I don't think it's fair to be downvoted because I didn't get it was a sarcasm :(
No it wasn't; it was the better part of a decade. Look, we all know Python 3 sucks (even if some poeple, unfortunately including the former Python maintainers, refuse to admit it), but this sort of blatant falsehood helps noone.
Everyone had 10 years of warning.