There are ways to keep SONAR running for years, yes.
But the questions we really need to address here are:
1) Do you use your computer for other applications?
2) Are you satisfied with all the current tools SONAR offer?
3) Are you worried new standards might come along that won't be compatible with SONAR?
Yes, turning off updates is a solution. But, it is also a security risk, specially nowadays. In my particular case, the answers are:
1) Yes, I run other applications on my computer, some that need Windows to be updated so they can run their latest versions, Adobe Cloud being the main one.
2) Yes, I am satisfied, but there are some features I would like to have that it doesn't offer (and likely won't anymore). One of the main ones is the ability to freely customize my I/O setup.
3) Yes. More and more we see plug-ins developing particular communication/integration engines that improves workflow, compatibility, and latency. Steinberg will eventually release VST4, Melodyne will improve upon it's ARA, Propellerhead will release revisions to Rewire, and, although there are no immediate plans or needs, MIDI 2 might get developed. These are just some realistic examples, it is also possible that new standards might come along as well.
So for me, yes, it is worth upgrading for the reasons I have (not exhaustively) mentioned above.
But, if these are not particularly worrisome to you, then I see no reason why you shouldn't be able to continue using SONAR for many years to come. It is a great piece of software and even with Windows rolling out major updates twice a year now, I don't realistically see them interfering with SONAR in a manner that would render it unusable any time soon.