Android has had many kinds of security issues over the years leading to RCEs. The scariest issues are ones like the "Stagefright" vulnerability that let an atta

Android has had many kinds of security issues over the years leading to RCEs. The scariest issues are ones like the "Stagefright" vulnerability that let an attacker take over your device just by sending a malicious MMS, with no user interaction. That specific vulnerability is old and patched nearly everywhere, but there's zero reason to believe vulnerabilities just as disastrous and easy to exploit won't happen again, or that they won't affect a broad range of phone vintages, such as a range from before the Note 5 all the way to the Pixel 5, simultaneously. E.g., as best I can tell the Galaxy Note 5 stopped receiving updates around 2017, at Android v7. But in late 2019 a vulnerability was discovered allowing remote code execution of Android v7-v9 devices if an attacker can just get them to play a malicious video file. And since the Note 5 isn't receiving security patches, that'll be a threat every day forever until you upgrade. Think how many video files you see on social media, or video ads inside cheap apps you downloaded, or autoplaying videos online. Threat vectors are everywhere, and there's not a lot that classic "sensible online behavior" can do to protect you from this vulnerability. Living with a phone that no longer receives security patches is taking the non-negligible risk that someday your phone will start transmitting your sensitive keystrokes and screen content and you won't even know it until the bad guy uses them. It's tragic that Android phones are considered "good" when they provide three whole years of updates. Having spoken to an Android engineer about this I somewhat understand the legitimate technical/business drivers for that reality. But still, it's tragic that perfectly-good phones become a danger to users and incentivize otherwise-unnecessary upgrades because of their short update policies.