Also, everyone on a Kindle Fire. My understanding is that since Firefox isn't in Amazon's app store, users need to download and then sideload it which means not getting auto updates.

I've been considering getting one and that's one of the things that's held me back (I use Firefox as my browser on my current tablet I'd be replacing)

Android 5 was released in 2014. It's time to move on.

Is anything which is older than 6 years considered legacy now? Should this be the expected lifetime of smartphones? Please not.

Smartphones, no (although with batteries being almost universally not replaceable now, six years is usually a difficult prospect without some delicate surgery), but a particular version of an OS, I think six years is plenty reasonable.

The root of the problem is that phones have so much proprietary hardware with closed source drivers that prevent the end-user from keeping the OS up-to-date like we can on PCs. If I wanted to, I could put a completely modern version of Linux on a 15-year-old desktop and it'd work fine, assuming the hardware's still fine. But with phone OSs you're completely at the mercy of your phone's manufacturer for OS releases, and so "six year old smartphone" necessarily means "smartphone missing probably at least 2-3 years of security updates and multiple OS versions behind the latest". It doesn't have to be that way, but that's the world phone manufacturers have created for us, and they have no incentive to change it.

In software terms, yes, you should avoid running anything internet-connected that hasn't been updated in that long.

The problem is, of course, manufacturers who refuse to support their phones with updates for more than a couple years. Many 6-year-old phones work just fine (some needing battery replacements at some point), but any 6-year-old phone that hasn't had updates in 3-4 years sadly just shouldn't be used if you value security at all.

You shouldn't be running outdated software on an internet connected device. I don't think any company updates their Android phones for that long. Samsung supports their devices for 3 years. Google might be a bit longer for the Pixel devices but they did drop their old Nexus line quicker. This isn't to say that the hardware needs to be given up on. If you want to use a community developed custom ROM like LineageOS then you can use a device longer.

I don't think any high end devices have user replaceable batteries and the battery is likely to be very degraded after 6 years of use.

If you plan to use an android phone for a long time (>2 years as manufacturer very rarely push updates beyond year 2), you should at least try to purchase a phone with active community support. For example, LineageOS wiki provide a list of such devices here: https://wiki.lineageos.org/devices/

It doesn't mean that you should toss your phone away, but from a security perspective your operating system is very much a legacy if it didn't get any updates for 6 years. Luckily on Android your can often flash an alternative ROM when official updates are over.

The current expected lifetime of a smartphone (and laptop for that matter) is about 2-3 years. After that the batteries start to degrade. when the batteries start to degrade most devices start to down clock to preserve battery life. And even if they don't down clock they stop being as useful as their intended purpose.

When was its last update, though? ex. Ubuntu 14.04 was supported through last April.

Who says these 10% are using Firefox in the first place?

That data is getting close to a year old at this point. "Each snapshot of data represents all of the active devices during a 7-day period ending on May 7, 2019"