You should move to a supported OS to reduce chance of getting hacked.
He also loves the built-in applications like Photo Booth that lets him record own videos and apply silly special effects to send to the grandparents. So, moving to Linux or Windows is really a non-starter.
How do you know that? Your machine is probably still susceptible to POODLE.
He is on non-admin account doesn't mean the OS doesn't contain bugs that allow privilege escalation. And Apple is definitely not going to fix those bugs.
Regardless, for me it's more about risk management. What's the more likely scenario? That an attacker compromises my internal network in order to launch attacks on my son's OS X box to compromise it via some known service exploit or an attacker serving malware that targets Flash vulnerabilities via a compromised host or ad network?
I tend to read more about the latter category than the former.