This isn't a static website we're talking about — WordPress is probably one of the most attacked web software in the world given its footprint.
WordPress doesn't do LTS releases or backports either.
> The only current officially supported version is the last major release of WordPress. Previous major releases before this may or may not get security updates as serious exploits are discovered.
> …
> Security updates will be backported to older releases when possible, but there are no guarantee and no timeframe for older releases. There are no fixed period of support nor Long Term Support (LTS) version such as Ubuntu’s. None of these are safe to use, except the latest series, which is actively maintained.