maybe it's because it doesn't need updating

The ground shifts under software. OSs change, dependencies get updates, engines change, compilers are improved occasionally in ways that aren't backwardly compatible. If the maintainer isn't at least checking it's not broken, and updating a changelog to say that it's still working, then you can't safely assume it's fine. "Not updated for years" is shorthand for "It could be broken, but I don't want to be the person who goes through the effort of checking."

If you want people to run your code against a set of pinned dependencies from the last time it was updated then that's one thing, but if you people to run it with an up-to-date set of dependencies on a new OS and on the latest compiler or runtime, then you can't just say it's 'done', because things can change outside of your code that means it won't work any more.