Many servers still run 2003, ignoring all security warnings, thinking they are no possible target. I guess it doesn't matter that much for one-man companies who are self-supporting, though. It's just how vulnerable you think you are, and how willing you are to put a grand towards an upgrade.