This has been happening for eternity. I remember distinctly the day we deprecated IE6, 7, and 8 from the retail website I maintained. We literally went out for happy hour that night to celebrate on the management dime.
It's not about security necessarily, though it can be. The main issue is using frameworks and web servers that support old versions of browsers (depending on how old we're talking) means you need compatibility layers which sometimes means multiple versions of the same website needs to be maintained, and can prevent you from upgrading to the latest versions that no longer support those old browsers.
Sometimes that means you don't get a feature you want or need. Sometimes that means you get delayed security fixes. That, and testing for backwards compatibility is awful.
Think about it this way- old browsers run old versions of JavaScript, CSS, in extreme cases, old versions of HTML. Some of those have backwards combatibility for a few major releases, some don't. Supporting multiple of those for a complex website is a huge undertaking.