The firmware for the Nexus 5 wifi chip has well-known remotely-exploitable code-execution vulnerabilities [1] that were never patched. Nearly all modern devices have a full software stack inside the wifi (and other radio) chips and they all have plenty of security flaws and they're all proprietary and unaffected by the OS.

So it's not just about it not being secure going forwards. It and most other similar age handsets are insecure because a fix has never been released for the older chips.

[1] https://googleprojectzero.blogspot.com/2017/04/over-air-expl...