Those versions are so far removed from receiving any security patches I'd probably want management to sign off that they heard me state this and they take full responsibility if shit hits the fan.
Also, are you at least a little concerned about your career using a tech stack that old?
I work on multiple projects, the main one i work on i recently upgraded from 5.2 rails to 6.1, and ruby 2.7 => 3.0
I learned Rails a year ago and haven't seen any sign that should concern me.
This is fine, until someone comes along and asks can we "just" do <this>? Someone tried to foist a Laravel app on me, to update it with some new functionality. It was so old, I had to setup a Linux box with manually-downloaded versions of PHP and the framework. Not being familiar with Laravel, I needed lots of docs and examples. They were impossible to find, and it turns out Laravel from that long ago doesn't work very much like today's version. You're in luck here, because Rails 3 works pretty much the same way as 6 and 7.
the mindset "if it works, leave it there"
edit: also it's a big project without specs, good luck at finding broken stuff...
Going to sound nuts but perhaps you can leverage ChatGPT4 to start generating some tests, based on some prompts for like 20% of your app. you just have to be pretty disciplined about how you write your specs.