I see that, security updates, APIs changing for security reasons and what not, but surely the attack surface of just about every OS has gone up, not down, in the process? Maybe its a bad idea to keep changing things that work all the time?

There are reasons to make things better. You don't want to be stuck with the same thing that was invented a hundred years ago. But this thing, where if you write some software today that, unless you work on it basically full time just to keep it working it just won't work in even 10 years without a full time legacy support team, that's senseless.