With no security updates in several years, I would get it off the public internet sooner rather than later.I just use it for image and document back up, I can also access it from anywhere online if I need an image when I'm not at home.
Most of the time it's just on for backups, non internet but if I'm away for a few days I leave it on so it is live to the internet. It was fine 10 years ago when backup software was limited and cloud backup was a fortune, but I'm at the stage I could get by with a WD My Cloud type option and sell the server.Is it internet facing, or on a closed LAN?