Users might put themselves at risk, but the platform isn't.
There's another category of risks that are associated with an expired certificate that does affect the platform, and they're not actually directly related to security. When a big website let's a certificate expire, there is a pretty big trust withdrawal from the users. Even if an expired cert on a website doesn't yield any security incidents, the big scary warning browsers present users essentially broadcasts to the internet that security isn't a priority for this site. It's possible that is not an accurate description, but it doesn't matter. Perception is reality, and everyone is seeing the big old security warning attached to their site. This can lead to an immediate drop in sales and/or cut off other revenue-generating things like ads. This effect can be felt short term until the issue is resolved, and can also be long term if the brand's credibility is severely eroded.
Remember how this site was hacked a couple years ago, and minimum of 25% of users' passwords were compromised? That happened because they were knowingly using a weak algorithm to hash the passwords. RadioReference was reactive, not proactive, in ensuring it's users were safe - they only began using more secure password storage because they got caught with their pants down, figuratively. And again here we are, RadioReference is demonstrating that they are still reactive and not proactive with their platform's security.
Use these and other past security incidents here to determine you own level of trust with this website.
