I was curious how long ago the latest server update actually happened. In my OP I posted the version list from Wikipedia. Now here is the version list from Apache:
To recap, they are using Apache Tomcat 6.0.35. Version 6.0 was "sunsetted" in April of 2017 with the final point release 6.0.53. That means there won't be any more security or maintenance on 6.0.
Based on the document linked above, the version they are using (6.0.35) was released on 2011-12-05. Then the next point release after that (6.0.36) came on 2012-10-19. The point release they are using was basically a minor release in between two bigger point releases, nothing that special about that. That helps my theory that they were just using the latest that was available at the time.
So it is safe to say their server software hasn't been updated since sometime in late 2011 or 2012. Security patches on their end wouldn't have been available since April of 2017.