Drupal - Will Drupal 6 be left in a secure state after it becomes unsupported?
Once Drupal 8 comes out, Drupal 6 will be marked "end of life": the Drupal security team will stop working on it and official security releases won't come out for it. If any new vulnerabilities come out, you'll have to patch it yourself. So it's really in your benefit to upgrade at that point.
But upgrade paths for Drupal are from the previous version to the current version: that is, an upgrade path is provided from the last release of Drupal 6 to Drupal 7, and an upgrade path will be provided from Drupal 7 to Drupal 8.
There won't be an upgrade path for Drupal 6 to Drupal 8: if you don't want to rebuild your site from scratch when Drupal 8 comes out, you'll need to first upgrade your Drupal 6 site to Drupal 7, then upgrade to Drupal 8.
So, it really comes down to economics and long term planning. Drupal 6 will be supported until Drupal 8, but when Drupal 8 comes out in a couple of years, will you have an opportunity to rewrite the site? If not, you should plan to upgrade to Drupal 7 at some point in the future.
I think until some of the major contributed modules like Views have Drupal7 modules that are stable and not alpha, beta I think drupal6 will be used for some time to come.
I'm certain that drupal6 will be supported for years to come as there are A LOT of drupal6 sites out there.
So the answer is No you don't HAVE to upgrade.
There are always 2 versions of Drupal supported at the same time. So when Drupal 8 will be released, Drupal 6 will become unsupported. There is some time left until that will happen, so you don't have to hurry.
If enough people are willing to continue patching security bugs, you might continue to use it safely even if it is not officially supported anymore. Anyone that wants to can continue to support Drupal 6 with security patches indefinitely, the question is whether enough people are interested in doing that. I would not count on Drupal 6 being still supported after the official release of Drupal 8.