To illustrae this point with an example (albeit a much simpler one than the F35):
When we "upgraded" the computer in the Sea King in the late 1990's (with one that was already obsolete and the USN had declared unsuportable past 2000

), there was no plan to either update the main mission simulator or produce procedural trainers. We developed in house both, using custom software which ran on Windows 95, and shared some components. These trainers existed until the retirement of that computer around 2015, and continued to run Windows 95, even though it had gone out of support in 2001.
The reason that was possible was that it was a closed system. We didn't have to worry about threats from the outside (the internet) becuase it was not connected to the internet. Any upgrades to the software were done in house, and therefore the limitations of both Windows 95 and the underlying hardware could be accounted for. As the PC model it ran on was life cycled out of other roles (general office duty) enough of them were gathered up to act as spare (yes, mid 90s PCs were still running fine in 2015).
This doesn't apply just to the military by the way. Lot's of critical infrastructure (eg oil refineries, power plants including nuclear, power distribution, air traffic control, etc) uses the same support model. It has the benefit of being a known entity so not as many unknown issues, but can become expensive to support when spares run out. Hence while for a time there was an active market for running PDP-11 (ant other) mini-computer code on PC architecture. A huge problem happens when some "bright idea guru" decides it should no longer by separate from the internet, "becuase we could do this and this if we just connected it."