Well, uptime is usually about the kernel; it being high doesn't necessarily mean that the network-facing daemons (httpd, sshd, and so on) haven't been updated and restarted. Running an ancient kernel does mean you're more vulnerable to local privilege escalation, but an attacker would have to obtain local code execution first. It being an "old blog", there probably wasn't much more running than the SSH daemon and a web server, serving either static pages or some simple PHP pages; the attack surface wouldn't have been that large.