They hopefully mostly sit inside an unexposed subnet and aren't reachable from the internet, but I've seen several companies running their public facing production applications on an unpatched EOLed Windows that hasn't been rebooted in years because the person who set it up no longer works there and they're afraid to find out what one time scripts he ran to get the system running without setting up any persistence.