Not all companies can afford the huge cost that can be associated with the support costs in such cases. Just consider how much Microsoft is making from custom support for IE8 with Government departments and big companies that neglected to upgrade their intranet to work with more modern browsers. All that money just so their browsers will get security patches.
Big companies can keep running old versions of PHP on their dedicated servers until someone finds a way to exploit the security holes. Hosting providers are unlikely to continue offering old unsupported versions if the slightest hint of never to be patched security holes arise.
Anyway with the interface between PHP and mySQL the two improved versions of the interface that are still in use were both introduced in July 2004 so there is no reason why any company that started on the web in the past 12 years would have started using an interface that was obviously going to be eventually removed in the first place.
Anyway any company with a security section should have had that section insisting that one of the new interfaces be used for all new development work from about ten years ago as there are significant security issues with the old interface (wich is one of the many reasons why it was removed).