Java 5 is now well past its end-of-life date. Sun/Oracle will no longer issue public updates to it.
Java SE 5.0 is in its Java Technology
End of Life (EOL) transition period.
The EOL transition period began April
8th, 2007 and will complete October
8th, 2009, when Java SE 5.0 will have
reached its End of Service Life
(EOSL).
If you find a bug in Java5 now (e.g. a hotspot crash – they do happen), you’re screwed. If you have a dedicated support contract with Sun/Oracle, which they do offer for those stuck on obsolete versions, then they can fix it for you.
You could argue that the risk of staying on an unsupported platform is greater than the (more manageable) risk of migrating.