What I object to is this:
What I object to about that is that it isn’t true. Not behind corporate firewalls: not at home.
There was a time when directly connecting an unprotected Windows computer to a modem connected to the internet, would get you pwned: that time was 20 years ago. But right now, getting pwned only happens when you have specific, unusual services directly connected to the internet, or when the user engages in specific dangerous activity, most of which is equally dangerous on supported and unsupported versions of Windows. And many, many people use older unsupported versions of windows for the internet without getting pwned.
Right now, it is difficult to use the internet with Windows 98, 2000, or XP, because the modern internet requires javascript features and security protocols not supported by browsers on those platforms. On the other hand, most modern exploits are also unsupported by those platforms
So it was never the case that it ever became more dangerous to use those platforms after support ended: quite the reverse: and the widespread introduction of NATing routers removed the biggest danger of using unsupported OS versions.
I’ve removed systems that were fully exposed to the internet, that had specific, well known flaws, and even those were unpwned. The subset of exploitable bugs that actually leads to COVID-like pandemics is quite small, and even of those, the subset that affects out-of-support home systems is even smaller.*
Which, to date, leaves many out-of-support home systems unpwned forever.
You, or anyone, can argue that a system which depends on the user not doing something wrong, is inherently unsafe. I note your profession. But that is not the same as saying that failure will happen. Actually, many users go forever without doing anything wrong, and their systems, supported or unsupported, do not get pwned.
And when it does happen, MS released a WannaCry patch for XP, even though XP was out of support. WannaCry was ineffective on Win2K, and not possible on Win98.