For one, a large number of native applications use the OS's webview widget, so you remain exposed to the outdated Safari engine even if you don't use Safari.

You're also going to have to use outdated versions of various software packages, as you describe in your post. That's another security hole.

As you note, bugs are often found in video and image decoders. The one in your OS isn't being updated anymore.

And consider that not every fix for a segfault or other bug gets labeled as a "security patch", but that doesn't mean that they don't present security issues. I imagine most engineers fix the buggy code and move on, and never really consider if there was a security hole there. In other words, it's common for vulnerabilities to be discovered long after they were fixed. And there are probably many more that remain undiscovered despite being present in old versions.