WordPress blog I didn’t upgrade has 3657 spam filled comments awaiting in moderation. It pays to update even seldom updated blogs.
Source
https://twitter.com/danielmcclure/status/1204695068
https://twitter.com/danielmcclure/status/1204695068