packages that become unmaintained and then orphaned should no longer be installed / removed from systems / replaced by alternatives
the only way i see "the last update was some time ago" is when a software is "finished" as in "the devs doesn't plan any changes and there're no issues left" (as for "but what's about security"?: think about languages like python or java - when done proper the code itself can be written in a way it never need to be touched again when "it's done/finished" - the actual issues are down in the runtimes like the jvm or whatever the python equivalent is called) that such a package still can become "outdated" and requires pkgrel bumps every now and then just to tell the system "hey, this software is still relevant - but only as is"
i don'T know but i guess this could be true for at least some packages: someone back at some point wrote some small helper which was "done" back then and never needed any more touches ever since - but it became unmaintained and orphaned just because no-one bothered with these otherwise useless necrobumps to keep said package active

overall: same with a lot of arch and the wiki: yes, i see it can benefit from improvements - but i'm not the one to even suggest them