About 5 years after this question was asked, here is another answer based on what we know today ...
Will Drupal 6 be left in a secure state, come the day that it is unsupported?
Drupal 6 has been announced to be end of life as of Feb 24, 2016, as detailed in Drupal 6 end-of-life announcement (*). So unless you take some appropriate actions, sites that will still be using Drupal 6 after that date are at risk of becoming insecure.
However, in the meantime the myDropWizard module has been released ... for D6 ... still, and only !!!. Refer to "How to get accurate information about available security updates after End-of-Life?" for more details on that.
Or will the platform become deprecated and vulnerable forcing an even more massive upgrade on me?
For situations where "upgrading a D6 site isn't an option", a possible alternative is to Buy Drupal 6 Long-Term Support (LTS) from one of the “official” vendors. Moreover, there seems to be the D6LTS project. For more details on that, refer to the answer to How to proceed with a D6 site after Feb 24, 2016 when D6 is end of life?.
For those who wonder "How many reported Drupal 6 installs do we have left?", go check the Usage statistics for Drupal core (about D5, D6, D7, D8)... As of Jan 31, 2016, there seem to "only" be about 110K sites left (as compared to about 1046K for D7, and 64K for D8). That's about 40K less as compared to a year ago (at that rate it'll take another 3 to 4 years ...).
(*): this link also contains a lot of interesting comments, such as the very first comment below it, which is like so:
By definition, a release on a project page is supported when two conditions exist:
- the project maintainer believes it to be supported.
- the security team is accepting reports of security issues and making advisories about it.
That's what "supported" status means and has meant since May of 2009 (and reiterated in May of 2010).
That is why item 4 is in this list:
All Drupal 6 releases on project pages will be flagged as not supported.
As of the Drupal 6 EOL, item #2 will no longer be true so it makes sense to mark them as unsupported.
This post about the EOL is the result of numerous conversations over the past 3 years about when the EOL should be. People who want Drupal 6 and/or contributed modules to be supported longer.