10 year old .NET is running on a Windows server that, I hope, you've done some security updates on. Having worked on most web facing stacks out there that might have been the worst one you could have picked as a "future proof" deployment, unless you're comparing them all as something you release once and then never touch again.

But did running Windows Update ever break the website?

Indeed. And did it require a Jira ticket to rearchitecture the app.

guess it depends on def of framework. I would say using .net mvc is a framework.