@svavar @thomasfuchs I mean, to be clear, I do think security issues should be updated against. The current version of RHEL is 10 and the last release of RHEL 5 was in 2014 — more than ten years ago — so Amazon AWS making the decision to stop supporting it is very sensible and frankly anyone using a base that old should have counted on this happening by now. (Even if this is mostly internal, it's still kind of asking for trouble for the OS itself to be that old in something that may potentially be a hack target.)
Actually, I think you demonstrated my point on the other end. It was a setup that lasted — more than ten years...
I think this whole topic is just discussing slower update paths where you don't get small, poorly tested updates every other day, not "don't update ever."