The gains are real
Each recent major version has brought meaningful throughput improvements. Sites moving from an end-of-life version typically see response times improve without a single line of code changing.
Security support ends quietly
An unsupported version stops receiving fixes even for serious vulnerabilities. Hosts eventually force the upgrade, and being forced during an incident is worse than planning it.
How to upgrade safely
Copy the site to a staging subdomain, switch the version there, and walk the critical paths — checkout, login, forms, admin. Most breakage is in abandoned plugins, which is useful to discover deliberately.