It is not recommended in any way to maintain a website on the 4.9.9 WordPress release to support legacy code that is poorly written. Although some of the security patches may be backported, scriptbots will target your website seeking out known exploits to access user data. According to WordPress:
“The only current officially supported version is WordPress 5.0.1. Previous major releases before this may or may not get security updates as serious exploits are discovered… WordPress will be backported security updates when possible, but there are no guarantee and no timeframe for older releases. There are no fixed period of support nor Long Term Support (LTS) version such as Ubuntu’s. None of these are safe to use, except the latest series, which is actively maintained.”
Explaining this to your client directly & making clear the security risks is most important. Create a development sandbox on a subdomain & test the WordPress updates for compatibility before you commit the changes to the live production website.