about three quarters of the web runs on php, and a large share of it on a version that stopped receiving security fixes. one address, one answer — and what it means in plain language.
no fixes means no fixes: once a branch is out of support, newly found holes are never patched. the version number alone tells an attacker whether it is worth trying.
it gets slower and more expensive: each version is measurably faster than the last. an old php costs you server capacity you are already paying for.
the upgrade is small if it is not late: a planned upgrade is a staging copy, a test, a switch. an upgrade forced by an incident is a weekend.
a copy of the site on a staging server, every page tested, plugins updated, then the switch — usually without a minute of downtime. fixed scope, fixed price, after we have seen what is there.