The root of the problem is that phones have so much proprietary hardware with closed source drivers that prevent the end-user from keeping the OS up-to-date like we can on PCs. If I wanted to, I could put a completely modern version of Linux on a 15-year-old desktop and it'd work fine, assuming the hardware's still fine. But with phone OSs you're completely at the mercy of your phone's manufacturer for OS releases, and so "six year old smartphone" necessarily means "smartphone missing probably at least 2-3 years of security updates and multiple OS versions behind the latest". It doesn't have to be that way, but that's the world phone manufacturers have created for us, and they have no incentive to change it.
The problem is, of course, manufacturers who refuse to support their phones with updates for more than a couple years. Many 6-year-old phones work just fine (some needing battery replacements at some point), but any 6-year-old phone that hasn't had updates in 3-4 years sadly just shouldn't be used if you value security at all.
I don't think any high end devices have user replaceable batteries and the battery is likely to be very degraded after 6 years of use.