When the security updates stop, the phone should be wiped of personal data and isolated from both cellular and wireless networks. There should be no compromise on this, a phone has access to far too much personal information and local wifi networks to ever consider using it beyond is support lifetime. Additionally, we should all be more diligent ensuring our personal devices install security updates as soon as they are available especially before going to large events (conventions, sports games, F1, etc...) or areas which are high traffic (airports, etc..).