TLSv1.0 should be disabled across the board for a few reasons:
​
1. TLSv1.0 in any form is now a PCI DSS must-fail item, regardless of any individual ciphers given grade by a third party service.

2. POODLE attacks, per CISA:

All systems and applications utilizing the Secure Socket Layer (SSL) 3.0 with cipher-block chaining (CBC) mode ciphers may be vulnerable. However, the POODLE (Padding Oracle On Downgraded Legacy Encryption) attack demonstrates this vulnerability using web browsers and web servers, which is one of the most likely exploitation scenarios.

Some Transport Layer Security (TLS) implementations are also vulnerable to the POODLE attack.

3. ROBOT attacks, per The ROBOT Attack:

For hosts that are vulnerable and only support RSA encryption key exchanges it's pretty bad. It means an attacker can passively record traffic and later decrypt it.

For hosts that usually use forward secrecy, but still support a vulnerable RSA encryption key exchange the risk depends on how fast an attacker is able to perform the attack. We believe that a server impersonation or man in the middle attack is possible, but it is more challenging.

Additionally, the TLSv1.0 RSA ciphers do NOT support forward secrecy.