Take a look at AROS-EXEC.org. They are running a slighly new version of Xoops than we were running. They are getting hacked, currently are. Some trojan is getting inserted into their pages. Upgrading to a newer version of Xoops as they came out, they would be now be running the newest Xoops on PHP 5. Likely not haveing this issue as the security hole being used would not be there. What happens when there host ends PHP4 support? If they are running on their own colocated server, nothing. They can run whatever they want, but at the mercy of the security holes in PHP4 and the version of Xoops they are running. I don't know what their hosting situation is but I wonder what will happen.
As to PHP, sure the core does stay the same mostly. That doesn't help, unless that is all your software uses. I also moderate on phpwsforums.com, a support forum for phpWebsite CMS. I watched alot of people have issues with one version when hosts started switching to php5 only shortly after php5 was released. Version 9 of phpWebsite didn't completely stop working. There were three or four commands that were not php5 compatable. Which meant the sites worked but some core feature were broken or didn't work right. Plus you have all the third party addon modules. Some which didn't work at all. Some modules broke when the phpWebsite core was updated to be php5 compatable.
There was also a small issue whe mySQL 5 came out.
Oh, I still know sites out there that still run phpWebsite 8. So, yes some do keep moving to hosts that can support their site. Most of these out of fear of data lost which can happen in upgrading. phpWebsite has gone through two complete rewrites, so upgrading and data migration is not exactly one to one. These phpWebsite version 8 sites do run at a costs. Limited hosting and that version is very easy to hack.