why are people who work in the industry surprised when everyone else that doesn't, doesn't want to invest into the industry?

I have a working system. its getting old. that doesn't mean it doesn't work. it doesnt mean its inherently unsafe. scaremongering your clients isn't honest business.

the recent sharepoint exploit, which was a zero day like any other zero day that could affect any product, and in fact, the same month, there was nearly as bad an exploit for cisco ISE devices for example. age isnt a reason for a product to be unsafe. nor is it being near end of life, or even if it is end of life, if its internal use only. (protected network use)

all of this is also ignoring the real costs of a lift like that. I know organizations with literally billions of sharepoint data records. some of them with legal holds. many with custom workflows and reporting that modern online solutions either do not support, or would charge so much money to operate, as to not be logical to pursue. Compared to an old, paid for, on prem solution that is working? the risk vs cost becomes far more acceptable toward risk to simply wrap the environment in a protective layer.

The (much) better way to sell these solutions isnt to talk about risk to people. its to bring up rot and loss.
As I worked with sharepoint programmers to recover from the exploit, the most common thing I found was how much the scope fell as discovery moved foward. Systems that were externally connected and thus, subject to the driveby attacks, were thought to be very critical, only to discover during recovery, that in many cases, less than half the resources being hosted were still in use or needed. Migration at that point to working systems became more of a cleanup of a legacy system than a threat recovery. downsizing the solution, changing its public footprint, and in many cases, removing that public footprint.