IIS 6 is part of Windows 2003 Server, therefor it will be on "Extended Support" until 14/07/2015

http://support.microsoft.com/lifecycle/search/default.aspx?a...

This means that if there is some security vulnerability discovered with it then Microsoft will provide a patch, therefor from a security point of view it isn't "out of date".

The number of years and versions is fairly irrelevant, there will be plenty of very secure systems in use by banks and the military that will no doubt pre-date much of what tesco is using by several decades.