This has been happening for eternity. I remember distinctly the day we deprecated IE6, 7, and 8 from the retail website I maintained. We literally went out for happy hour that night to celebrate on the management dime.

It's not about security necessarily, though it can be. The main issue is using frameworks and web servers that support old versions of browsers (depending on how old we're talking) means you need compatibility layers which sometimes means multiple versions of the same website needs to be maintained, and can prevent you from upgrading to the latest versions that no longer support those old browsers.

Sometimes that means you don't get a feature you want or need. Sometimes that means you get delayed security fixes. That, and testing for backwards compatibility is awful.

Think about it this way- old browsers run old versions of JavaScript, CSS, in extreme cases, old versions of HTML. Some of those have backwards combatibility for a few major releases, some don't. Supporting multiple of those for a complex website is a huge undertaking.

Older browsers lacking certain APIs / features.

E.g. let’s say you want your app to use WebUSB to interface directly with a USB device. Oh wait, can’t use that, Firefox and Safari don’t support it yet.

Developing web apps can be a pain when you’ve got numerous browsers with different web standards implemented to varying, inconsistent degrees. Compound that with supporting older browsers and you’ve got a web apps not able to leverage modern features and suck using lowest common denominators.

Honestly, browsers are the most dangerous membrane through which we let untrusted code permeate. One really shouldn’t be running old versions of browsers with unpatched vulnerabilities residing in them. I don’t see the problem in any web service ending support for browsers that are >6months out of date.