*If the system is sufficiently critical, it may be hard to update or migrate it. And if it's still safely working there's no real incentive to do so.
In the very short term, perhaps. But I'd argue that critical systems are the ones most in need of the ability to be frequently updated and migrated. What's going to happen when a serious security problem demands an immediate change, and you're not prepared for it? Or the system catches fire, or floods?
SPOF critical systems are why so many organisations end up in legacy software hell.
If the system is sufficiently critical, it may be hard to update or migrate it. And if it's still safely working there's no real incentive to do so.