It turns out that when an operating system is in service for a very long time without updates, bad things happen. Now if you want a real scare, consider for a moment all of the code running on embedded hardware that makes up the entirety of the world energy grid.
Imagine, for example, openssl being told about the heartbleed vulnerability, then being pressured into paying big money to prevent disclosure, and then keeping their mouths shut about it for six years. Except this is even worse because at least then someone could look at diffs. I can't even think of a proper analogy here.
Back in the day, I had an S60 phone but no way to even connect it to a computer to get the firmware.
Also, for those that still remember Heartbleed, read again the above comment and think what embedded hardware is running around you. It is a bit scary.
I recall doing an s60 software upgrade and having it crash halfway through, which somehow bricked the baseband and the operating system of the device. Go figure.
Heavily control and packet sniff anything moving between levels.