I've been told during an external IT audit the Juniper SRX routers used at our branch offices for our site-to-site VPN (IPSec?) are outside of support and represent a security risk.

Would you experts recommend upgrading?

How real are the risks and can they be mitigated without upgrading? 

Do organizations typically replace their branch routers every 4-5 years as they become 'obsolete'?