4chan was running FreeBSD 10.1, which hit end of life (no more security patches) December 31, 2016. The 10 branch (spanning 10.0-10.4) was EOL Oct 31, 2018.
https://www.freebsd.org/security/unsupported/
That's for the base OS and packages, and appears completely irrelevant for this exploit. They were using a Ghostscript PDF renderer from 2012, which is a famously buggy pile of shit:
https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=ghostscript
PDF is a very complex file format, and exploiting bugs in it has been a weapon of choice for hacking campaigns since the early 2000s. The attacker didn't even need to find a new bug, just browse the list of dozens of past exploits and pick one to use. The same technique is often used in console hacking, where they have ancient browser versions with dozens of exploits to choose from.