Re: But like the movie bad guy, SQL 2008 isn’t quite dead yet...
My guess is that using Azure would mean Microsoft could test flaws against their "best practice" installations and potentially mitigate security risks rather than patch them and hope that the cloud sales don't bite them if a serious flaw is discovered.
Having said that, the vast majority of the applications we use with SQL Server have been ceasing maintenance support for pre-2012 releases for some time and most have moved onto ceasing support for pre-2016 releases for some time as they move away from 32-bit code.
The only leftovers are the applications no one loves, thought they had already migrated off or are unwilling to pay to upgrade. I suspect they will take the "I hope it's ok" approach rather than moving to Azure.