Yeah I use this for very limited functionality like maps, whatsapp, uber eats. I am also mostly interacting with Google playstore for apps/apks etc. This does still leave the phone open for any day0s etc. but we will cross the bridge when we get there. I am not important enough for anyone to target me specifically and I also keep a low profile.

I was thinking about upgrading this year but I am now thinking of waiting another year since there are no immediate problems.

Which applications you use is almost irrelevant -- over the past several years, there has been a steady stream of "zero-click" exploits that allow an attacker to compromise phone with no user interaction. The remote code execution vulnerabilities discovered last year and this year in the modems used in Samsung devices require nothing more than knowing the victim's phone number.[1] And you don't need to be particularly important to be caught in a wide net, cast by criminals looking to build up a bot-net or harvest data from as many devices as possible.

[1]: https://googleprojectzero.blogspot.com/2023/03/multiple-inte...

All of this makes me think I should just switch to a flip phone. It's exhausting having to constantly drop hundreds of dollars every 3 years just to stay safe.

I have a Pixel 5 that does everything I want. Google will stop supporting it within the next year. It doesn't make sense to me that this device already needs to be recycled. Yes, I know about custom ROMs, but even those end support for perfectly OK phones (GrapheneOS for example no longer supports Pixel 3a).

I completely agree. My phone lost official LineageOS support last year but it still works fine and I cannot justify throwing it away to replace with a new expensive device full of features I don't give a damn about. Probably I'm just stupid but I'm going to keep using it until it breaks.

Have you considered GrapheneOS?

Where and how do you get Android malware? I'm genuinely curious.