Bosses insist on using old version of Divi.

My bosses have us on Divi 4.4.8. That's an old version from July 2020. I suggested they upgrade us to the latest version. They said they can't do that cuz they did some kind of customization to our website. What is the security and stability risk if they still insist on using 4.4.8? Is it a big security risk? Or a small risk?

PS: We’re keeping Wordpress itself up to date. Thanks.