Hi @decwodie, thanks for getting in touch.
If you still receive this result after running another scan, it has been seen from time-to-time that issues with the WordPress core update process not completing fully, file access permissions on your server, or something just temporarily failed when the update was done.
For example, WordPress 6.6 had some files not flagged for removal as they should have been. It was corrected for the next release.
Make sure to back up your site first if you attempt to delete the listed files yourself. Alternatively, you can exclude results for “Old WordPress core file not removed during update” from future scan results in Wordfence > Scan by selecting Ignore > Ignore Until File Changes next to the result. This will ignore the file until further modifications are detected or a future WordPress update removes them.
Many thanks,
Peter.