> If the old Android device doesn't get security updates, then it isn't safe to keep it connected to the Internet. That can be mitigated somewhat by it being a

> If the old Android device doesn't get security updates, then it isn't safe to keep it connected to the Internet. That can be mitigated somewhat by it being a local-only device with firewalls between it and the wider Internet (so it can call out as needed but nothing out can call in). There is still a risk of another device on your WAN, temporarily or otherwise being infected and passing on the problem - you could have an extra AP and keep such devices on their own leg of the network to reduce that risk. You'd still be prone to something that can attack an old unpatched device just by being in range of it, of course, so perhaps use some sort of exfiltration monitoring at your network edge (or the edge of that walled-off WAN) to hopefully detect an infection trying to propagate from the device.