Re: 5% of 1000 000 is 50 000 desktops.
"You don't replace equipment worth hundreds of thousands of dollars (or pounds) on the same frequency that you replace PC or operating systems." Quite correct.
You also do not put them on an intranet that touches the public Internet. Certainly not with an unsupported OS, and best never, as the cost if compromised may be a machine physically dangerous to users and others, and may be proportionate to the machine cost.