Well, I use a web browser on the phone. Chrome et al. are still receiving updates for my phone, but I'm guessing they use some system components that are not receiving updates? So my main worry is something like an ad network loading an exploit. You don't need to be a high value target to get caught in an extremely wide net like that.

(Yes, I know: get a better ad blocker, etc. — I'd rather have fewer weak links, though, and a lack of basic OS updates is a pretty big weak link.)