There is definitely a trough of vulnerability for older machines.

For Windows 3.1/95/98 I feel they were incredibly vulnerable in the 2000s and 2010s, but now they have aged so much where getting to them is becoming a hurdle and a chore preventing attackers from making it to the target.