This is a good question, and the answer to this precise question- "should I tell X that Y is not secure" is almost always "No." It's best to not give statements in a vacuum to a superior- provide context and explanations.
A boss needs actionable information and a framing to make a decision. No actionable information is conveyed in that particular choice of language, and no decision is presented. Furthermore, the terms "secure" and "not secure" have a useful meaning really only to security engineers, who understand that nothing is actually secure, and most things that are not-secure are may still be only rarely compromised, because there are so many not-secure things out there.
A better way to frame issues like this is to work through the implications and to convey the state of play as a decision that could be made. The decision here is whether to invest in changing to another protocol, perhaps through the change in IT providers.
A useful but not only way to frame a security investment decision is in terms of dollar spend on a form of insurance. There are many, many other consideration domains particularly in the context of security- regulatory and compliance, customer trust concerns that cannot be expressed in terms of dollars, and others. But in the same way that ROI is a useful common language to look at the investment and growth side of a business, insurance cost is a useful way to look at the risk side of a business.
Here, on the one side, one wants to look at the costs in dollars and time of doing an upgrade or transition, and the impact on the workflow.
On the other side, one wants to make an estimate of the costs of a breach. The basic process is to identify the potential outcomes of a breach, estimate the range of costs of dealing with them, and estimate the likelihood of them occurring within a particular timeframe.
This may seem like a lot to estimate, but all you want is a very, very rough ballpark of potential bad case scenarios, and for a small company with a small number of assets/customers/implications, one should be able to do that pretty quickly. All you really need to determine is if you talking about an expected loss of $1,000, $10,000, $100,000 or $1,000,000.
The cost of the upgrade is the insurance against the potential loss. A boss will be able to decide whether to get that insurance. If they do, great. If they don't, that's ok, too. If after the process you realize that some of the costs or risks were misunderestimated, as the saying goes, welcome to the club! Just continue the dialogue. The boss will appreciate it.