The fact that "it still works" isn't the only consideration though - it's the security posture. There's plenty of remotely-exploitable flaws in that software stack from 2013.
Well running unpatched stuff is no longer like that. I bet you could use a 2013 iDevice for a whole year and not get exploited once.
Exploits are mostly against the rich and famous now, and not so much against regular joe.
Was that actually true, or just an urban legend? I've heard this a lot back then, but never actually saw it happen.
Also, some ISP's blocked ports which protected you somewhat.
It was certainly quick enough that there was no way to get the updates installed before the machine would bluescreen (many of these exploiters didn't care much for the stability of your machine...)
Not a big threat downstream.
Nowadays, most security features and upgrades are designed to protect the device against its owner.