What's the risk? You own the code, and you aren't pre-committed to updating to any new versions in the future. You can just take it and use it on your own forever. Many people do. What's their risk?
This isn't a static website we're talking about — WordPress is probably one of the most attacked web software in the world given its footprint.
WordPress doesn't do LTS releases or backports either.
> The only current officially supported version is the last major release of WordPress. Previous major releases before this may or may not get security updates as serious exploits are discovered.
> …
> Security updates will be backported to older releases when possible, but there are no guarantee and no timeframe for older releases. There are no fixed period of support nor Long Term Support (LTS) version such as Ubuntu’s. None of these are safe to use, except the latest series, which is actively maintained.