He's using Firefox with updates. I guess they still provide browser updates for his version. TBH, that mitigates most of the real vulnerabilities.

It may even receive system web browser updates, as those tend to go on for much longer than OS updates with Android.

With a little care, it is likely to be fine.