Phoronix comments are always such a mixed bag. I get that something still running after 20 years is cool and all, but it's not necessarily a good thing.
Personally, I usually take issue with the missing institutional knowledge on such projects. It doesn't matter if it runs, it matters that we're running something we can fix if it explodes.
I recently built some stuff with the latest gcc compiler that was written in c89, but still compiled. That's pretty sweet and very convenient for us, but the flags and the commands aren't documented at all. So we have to spelunk through ancient scripts to find the right incantations or worse, read the code. Because who needs docs for an internal tool ammirite?
2fa isn't a panacea and won't solve every problem. It does help though. Why do you think supply chain integrity isn't something they care about?