Nothing immediately - and that's the trap. Outdated software is the number one way WordPress sites get hacked, and the longer the gap, the harder and more expensive the eventual update becomes.
The short version
Every update delays leaves a known security hole sitting open on your site, and automated bots find unpatched sites within days of a vulnerability being published. Old versions also stop being compatible - with plugins, with PHP versions, with everything around them.
The usual sequence
First the site is quietly compromised - spam links, injected redirects, or a mail relay. Then it's flagged by Google and visitors see warnings. Then the cleanup costs more than a year of updates would have, and the traffic that left doesn't all come back.
Why the update itself gets harder too
WordPress, plugins, themes, and PHP all move together. Update everything after two years of neglect and conflicts appear in every direction. Small, regular, tested updates stay boring - which is exactly what you want them to be.
A real example
A boutique fitness studio ran the same twelve plugins for two years without updates because "the site worked." When a critical vulnerability was disclosed in one of those plugins, attackers found the unpatched site within days - defaced the homepage and injected spam links that tanked their local Google rankings. Cleaning the hack cost far more than a year of updates would have, and the ranking damage took months to recover.
Rather just have it handled?
WordPress Care Plans
Updates tested and applied weekly, included.