Maybe I’m just old, but the idea of have a device on the internet that no longer gets security updates just seems wrong. Learned too many lessons back in the 90s and the oughts.

I'm a graybeard too (with a security background), and I got over this. The problem started when companies combined forced updating with no longer issuing security updates separately from other updates.

If it were just security updates, I wouldn't mind automatic installations. But feature updates are too disruptive. So I avoid automatic updates where I possibly can.

I accept that there's a security risk associated with doing this, but for me, it's a risk that's worth taking.

Didn't some recent Google Pixels have a baseband issue that allowed a remote takeover of an unpatched device by hackers knowing nothing more than the device phone number?

Security updates are not optional.