Not surprising. I guess Windows Server 2003 will stay with us even longer than Windows XP. Unless there will be some worm released exploiting IIS on those servers.
Banks, the Army... none of these care about these things. Not surprising, until recent years the password that would unlock nuclear weapons was "0000000" hehehehe. In the 90's, the UK's nuclear weapons were secured by a bicicle lock! LOL
Does it make any difference anyway? Windows updates are not the cure-all many people seem to think they are. Fully updated and you can still fall foul. Unsupported isn't the end of the world.