I believe that we may be leaving out the hosting companies themselves. They are also at risk because many of these outdated sites are running on their platforms. How about working with them to find a way to mitigate attacks on these older sites? They can either create a policy stating that WordPress has to be within a certain version OR possibly shut down sites that show issues.

Unfortunately that is the only way that some of these sites will ever be updated. That is not illegal because site owners have to adhere to the hosting company’s policy or they can move their site. I do find it hard to believe that another hosting company would welcome an outdated site. I don’t believe we need to force an upgrade, but if the hosting companies can get involved, they can get the attention of the end user.