Perhaps,
1. OS you used isn't that old.
2. There's background application which regularly obtain new trusted certificate.
3. The browser remain up to date even though it's on old OS.
Windows Server 2008R2 is pretty old, it went EOL back in 2020. Browsers are not always up to date on older OSs. I've seen Chrome and Firefox failing to update because new version is not supported by old OS.
No critical vulnerabilities is impossible, although no hacker target that server sounds plausible.
Again, from my experience Linux kernels are pretty solid and it's quite hard to get access to it remotely, unless an admin makes a mistake and leaves something open or remote access software like openssh has a vulnerability. So perhaps even if it's a "critical vulnerability" it's almost impossible to compromise such system remotely.