The only reason to keep the old version of Kryo and not either upgrade or remove Kryo is if there is a backward compatibility advantage. If backward compatibility is breaking anyway, this seems an easy choice.
Java record support was the big motivation to this upgrade. From some simple tests I've done, the Flink 2.0 branch code seems to work with Java records where Flink 1.x versions did not. The Flink 1.x code was automatically using Kryo, and the old Kryo fails with Java records, the Flink 2.0 code doesn't seem to use Kryo by default. However, you still don't want to pull a super old version of the Kryo library into the project. The Kryo code is still used widely throughout the Flink code base. The old Kryo 2.x is fundamentally incompatible with Java records and will fail if it gets called with a Java record or some other collection/class that has a nested reference to a Java record. Either none of that Kryo code is actively being used, in which case, it should be removed, or it is being used and will fail when used with Java records.