Ken is correct that the Atto and TinyMCE editors are integral to the Moodle version.
But if I may disagree: Moodle 3.8.6 is the latest 3.8 update and released last month so not old. Moodle 3.8.x is in support for security updates till May 2021.
Also, I don't think upgrading Moodle will change the TinyMCE version, I can't see any code differences between Moodle 3.8 and 3.10 for this.
Is the server tech alluding to a specific security threat or a general risk? I don't think there's an answer apart from removing this core plugin. This thread seems to suggest that TinyMCE is effectively deprecated but no official decision has been made in part because too many users may be using it.