A preferable course of action would be to just stop providing security fixes to version 3.7, even though the infrastructure is in place for these fixes to be distributed.

This will absolutely result in more old sites getting hacked over time. But between web hosts suspending hacked sites, Google/Bing showing warnings on search results for hacked sites, and Chrome/Firefox showing browser warnings when sites are compromised, I think the external ecosystem is advanced enough at this point that WP.org shouldn't feel like the burden is theirs to bear alone.

Maybe just make it policy that security fixes are backported 10 minor versions and be done with it.