LineageOS helps ( if the phone is supported by it: https://lineageos.org )
Aren't most LOS roms based on ancient kernels (albeit mostly patched-up with security updates), that use ancient modules, with opaque BLOBS/Firmwares, that only sometimes get updated, if ever?
You could run "HighSecurityOS WhatEv" on your phone, as long as e.g. the Wireless-Interface runs something entirely independent of you with DMA rights, and probably faulty firmware, can you really trust your device? Or have I missed recent advancements in this problem space?
PostMarketOS aims to mainline more devices/phones, so maybe, even if your final OS of choice is Lineage (or derivative), I would check their HWCDB before checking, if Lineage works on a phone.
But I haven't been able to find good info on what exactly the implications are. If I'm not worried about targeted attacks, does a device that is just a passive node pose a significant risk?
In other words, how much do security updates address targeted attacks (not my threat model) vs widespread attacks of non-updated phones?
Perhaps the most famous one on Android was the Stagefright attack, which could take over your phone by sending you a malicious MMS (which you didn't even have to open), or by getting the system media player to play a malicious MP3/MP4.
That was a while ago and I haven't kept current on similar attacks. Running an unpatched system is a gamble that nothing like that is still waiting to be discovered.
Which I would assume is not an issue if I'm using an old Android phone without a SIM card, so there's no way to receive any type of sms/mms message
Interesting, I've never thought of using an Android phone as a Syncthing node.
Is there a way for an Android phone to connect to Wifi, but not the internet?
I use Syncthing with local discovery only, which only needs the devices to be on the same Wifi network. Not having internet access and also not having a SIM card to get calls/sms/mms message should greatly reduce the risk of attack to the point where I wouldn't feel worried about it.
If you can manually set the IP address on it instead of letting the WiFi AP give it one, then you can just leave out the default gateway entry - The device will then have no idea how to route network data outside of your local LAN.
Alternatively, set up a different WiFi SSID that gives out IP addresses, but again without a default gateway address, and have your device(s) connect to that instead.
Or finally, if your router supports it, set a rule to block your device(s) (via it's MAC address) from accessing the internet.
I think the first option might be the easiest because it doesn't involve having to change anything on the router.
It does seem possible on Android to set a static IP and remove the Gateway (or maybe set it to 127.0.0.1 if I can't leave it blank?)
https://service.uoregon.edu/TDClient/2030/Portal/KB/ArticleD...
Lineage will try to scavenge firmware updates from other devices to upgrade what they can, but there might be problems with the wifi, bluetooth, or other firmware that can compromise the device.
This is less of a concern if your wifi connectivity is behind a NAT router, and Google is gone.
That can be mitigated somewhat by it being a local-only device with firewalls between it and the wider Internet (so it can call out as needed but nothing out can call in). There is still a risk of another device on your WAN, temporarily or otherwise being infected and passing on the problem - you could have an extra AP and keep such devices on their own leg of the network to reduce that risk. You'd still be prone to something that can attack an old unpatched device just by being in range of it, of course, so perhaps use some sort of exfiltration monitoring at your network edge (or the edge of that walled-off WAN) to hopefully detect an infection trying to propagate from the device.