The most accurate response is:
Legacy systems are risky to update as they are built on obsolete tools and technologies.
This is because updating legacy systems often involves dealing with outdated programming languages, lack of vendor support, and potential incompatibility with newer systems, all of which contribute to greater risk compared to updating more modern software.