My own recommendation would be to get it up to date. Then, install Wordfence or some similar security plugin. With the latest versions of WordPress, you can set it to automatically update the plugins which is great, because often hackers would find a security loophole in the plugin and exploit it. As soon as the plugin developers become aware of the loopholes, they update the plugins (with a bit of luck). But monitoring multiple sites and tons of plugins becomes a thankless task. Not any more thanks to this new feature.