Comment # 10 on bug 1159041 from Christophe Giboudeaux

That's a poor reasoning. KDE3 applications would still start but noone would
think about shipping these applications in any product.

Security is a reason for removing software. SUSE is free to sell insecure
software to its customers, but I don't want to ship insecure software to
openSUSE users.

If you need an example, CVE-2019-7443 affects kdelibs4 and will not be fixed
upstream. (kdelibs is not maintained anymore since august 2017 and Qt4 is
unmaintained since may 2015...)