Fair points. Both have solutions 
Regarding PHP changes… well, if plugins were more or less up to date on WP 4.9 it means they are around PHP 7. Updates won’t be a nightmare.
About security issues… well well. It’s not that those appear everyday, specially for the battle tested plugins that many use. But again. They can be solved.
What are the alternatives to this?