That’s true, but that just means it’s important to keep the OS updated. Each OS itself will have a number of updates before a completely new version is released, and even that usually has some degree of backwards-compatibility.
The same principle applies regardless. An outdated browser and / or OS (whether Apple, Android, Microsoft or whatever) should not be connected to the internet if you value your security.
That’s a sad thing to have to say, but important to accept in today’s environment. The cost of being hacked is far greater than the cost of a even a new MAC.