inactive blog – do I need to upgrade?

I currently have a blog that is inactive, though all of the WP mechanics are still in place on the server. However, I do have a static .html index page located there, so nothing can be rendered by WP, etc.

My question is whether I need to upgrade to 2.0.2 or not. I’m not sure of how security loopholes work. Does my blog need to be actively working WP in order to be at risk (in which case, no need for me to upgrade) or is it a security risk just to have the exploitable files on the server (in which case, I need to upgrade)??

Thanks in advance for any help. Hope this was clear enough.