The world has changed. No longer is an older but 'stable' operating system 'safe' or trustworthy.

For Windows, and even Mac, for most users the lowest risk computing only occurs when the machine is maintained with the most recent OS version and is fully updated. Anti-malware add on software cannot fully compensate for attacks targeting the underlying weaknesses of an old OS. New attacks leveraging old (but recently discovered) bugs and never corrected errors have become common. An old machine is now just a huge risk vector, especially if it is connected directly to the raw Internet, even for a short while.

User behavior, even sometime long in the past, is of course always a risk. Allow some piece of badware to be installed at any time and you are cooked, even if you don't realize it. Old OS just makes it harder to detect, let alone correct or defend against, even for moderately savvy users.