I would suggest instead that there are no legitimate reasons, and that businesses who are requiring old software are at best being negligent.
I’ve worked with people that refuse to modernize and update and it’s always the same stupid thing: “cost”. We really do need strong regulations on businesses that negligently refuse keep reasonably up to date.
2) it costs money to run a business, and saving money through gross negligence, leading to real people having real impacts through massive data leaks while suffering zero repercussions for that needs to end. “It costs money to keep software up to date” is a shit argument for why businesses should not be managing their software.
1. Backwards incompatible schema changes for data that the software works with which requires a migration path. The version for that software needs to be locked until that migration is complete.
2. A functionality regression in the software. The version needs to be locked until that patch lands.
3. A security vulnerability can be introduced with new features. The version needs to be locked until that security issue is patched out.
You can't just yolo to the latest version of software every time it drops.