There's also little incentive to upgrade
Maybe their incentive will be that if they don't upgrade, someone will just crash their server.
I deal with the same thought pattern at work on a daily basis. I develop on a very popular e-commerce platform that is notorious for being difficult to update due to poor compatibility with various customizations done to the application code. Clients come to me with problems their store is facing, and I tell them the fix is to update to a newer version. I then tell them that it may cause problems with all the extensions they've installed and that it takes time to get things all sorted out. This quickly puts them into "not enough incentive" mode.
What that really means is they value running their day-to-day business more than they value the sustainability of their business. They'd rather make $1 a day than save $365 a year.