Just because a plugin hasn’t updated in a long time doesn’t mean it is inherently vulnerable. It is perfectly possible for a several year old plugin to have a complete feature set and not have any security issues that require an update.
If you’re really worried and only want to use plugins that have ongoing updates and fixes then you’ll need to replace the plugins. If you can’t find a replacement and still really need the peace of mind, you could always hire a professional to do a security audit of some kind.
Other than that you should just make sure to implement the recommended security measures. There’s no magic bullet for making plugins safe.