Sticking with TLS 1.0 is a very bad idea and pretty unsafe. Can be POODLEd, BEASTed and otherwise padding-Oracled as well. Lots of other CVE weaknesses still apply which cannot be fixed unless by switching TLS 1.0 off.
Sticking with TLS 1.1 is only a bad compromise though it is halfway free from TLS 1.0 Problems (but since both protocols do not provide any modern cipermodes which are essential today, the modern encryption methods do not work here)
TLS 1.2 with CBC Ciphers ON and also RSA on is kind of a lotteryplay wether your connections are entirely safe or not. Which depends on how the ciphers are implemented on either side of the Connection (Server <-> Clientbrowser).
Recommended opmode as of now:
TLS 1.2 without any CBC Ciphers (that means also plain RSA handshakes off) is safe enough
only TLS 1.3 is safer because of its handling improvement and the exclusion of everything that went obsolete since TLS 1.2 came up.
(assuming all other unsafe 64bit including 3DES and RC4 ciphers are already disabled)