It's your first IT job and you've been there for a few months? While your safety concerns definitely can be relevant my advice is this
You should
Don't rock the boat as a new hire. Figure out what is going on first. Maybe there's a reason to some of the madness you see.
Do NOT contact the owners. Doing so will likely be seen as disloyalty by your boss and possibly the owners as well. Only go through your immediate superior.
Don't bring it up again with your boss. It's not your responsibility.
Leverage the user. Let the user be the one to push for a system switch.
You could
Figure out if you can get the system on a separate VLAN and get it locked down in firewall rules.
Research the system. Why don't your boss want it replaced? Does it run some ancient software? We've got some machinery that is running windows 7 at work. When I got hired, in the days if windows 8, the controller was running windows XP. The setting up of drivers and archaic proprietary software, involved in upgrading, is immense. When we switched to 7 this €60k equipment was down for days, and it was a week before it operated properly.
I'd modify the 2nd one from "don't do it" to "understand that doing this might burn bridges if they care more about the hierarchy than competence, so have at least one option that doesn't rely on them before you do this". That's with the mindset that I wouldn't want to stay long at a job like that unless this could be resolved and am willing to burn bridges in situations like that.
That's with the mindset that I wouldn't want to stay long at a job like that
Oh I concur, but elsewhere OP mentioned that the job pays a rather unskilled (OP mentioned having an A+) 20 year old 55k USD, and OP is getting certs as well. In that case I'd seriously be working on my STFU-skills, instead of meddling in something that my boss really wants me to stop meddling in. Maybe do a bit of CMA - but not to the extent of emailing my boss to get a paper trail.
When you've been in an organization for only three months, and it's your first job in the industry, maybe just absorb what's happening instead of trying to change stuff. Make up your own opinions, sure, but keep them to yourself. Maybe evaluate on how you perceived situations, and how they played out, and modify your views based on that.
Yeah, I have a piece of mission-critical gear that is controlled by a computer running Windows XP. Because the control program is written in Flash and modern systems won’t run it. Migrating to a modern system would require a complete rewrite in a new language, and would also likely kill a lot of functionality.