I wonder if in order to limit the size of the updates the AV companies
remove older viruses from their databases.
They are not.
Virus definition stay over time and as such take space. Antivirus structure their signature database for management purpose and and permit us, technical people, to be able to manage, repair, change and backup them since many years.
If so, how likely is it that a virus old enough to have been removed
from definition files, but not old enough to be obsolete would easily
spread, uncontrolled and undetected.
Being able to protect the integrity of the virus database is part of the security itself and a necessary monitoring activity (imho) 1. I think it could explain a bit why antivirus program are sometime so deeply rooted to machines they 'protect' and why it also happen that antivirus screw the operating system.
As IT sec, it could be part of your duty to manage risk upon factor such as compatibility and abandonware, etc. Since antivirus can screw-up just like any other software, they must be managed and so their virus definition either.
Excluding those signatures could reduce disk usage, reduce antivirus engine corruption occurrence, fragmentation, etc, and the risk would be managed, etc, just like distributing operating system/software/firmware update/installation, etc, over the network. Not all updates are useful for all computer park, etc.