This is maybe true for software that can never conceivably interact with the outside world (can’t open files, isn’t scriptable, etc) but at least on Windows and macOS where shipping static binaries or necessary libraries with the software is the norm, vulnerabilities pile up pretty quickly these days making it a bad idea to regularly use or in some cases even have installed software past a certain age. For these programs it’s better to just run them in a VM where compatibility can be perfect by running an old OS and the size of the potential crater resulting from an exploit is minimized.
It’s a bit of a different situation under Linux where the norm is dynamically linked libraries kept up to date with a package manager, but even there static binaries and things like flatpaks and app images can be bad news.