You'd need to keep an older client to keep around for old devices. Sort of like that VM with WinXP and IE6, the one that's only kept because it has a semi-working ActiveX that some ancient device only interfaces with... shudder
Possibly. You don't want to use the older client for anything except connecting to the older system. Keep it somewhere offline (encrypted, whatever: distinctly non-executable), too. (Not that it would solve the issue altogether, see Stuxnet for a sufficiently motivated attacker and airgapped systems, but it's a viable mitigation.)
Yes, but I'd be much more concerned about the SSH server.
I dunno, exploiting a vulnerability that lets you steal SSH keys from a sysadmin seems a bit more useful than hitting a single server.
As usual, it seems like it's a good idea for the open source project (ssh in this case) to drop old tech and move on while those dependent on it should maintain it, for whatever that means.