They have a choice: don’t upgrade. Really if their stuff is working they don’t need to upgrade. If they needed to upgrade they would have already.
Ya. The only risk are viruses. BTW, MSE is no longer supported.