Ancient android might not get security updates, but is actually still very usable. The vast majority of apps will still at least run and talk to their servers on a 10 year old phone.
My iPad 5 got an iOS update last month-ish? And a security patch last week. All of my kids run iPhone 8.
I use LineageOS and it is true that I have to use Magisk to have banking app working. And I understand that this is not for everyone.
I just wanted to mention that there is a way to use older phone and have security updates longer than vendor provides it. And even longer than Apple.
I get the argument about binary blob updates. Security is never 100%. And it also shows another reason why binary blobs make things worse.
It may even receive system web browser updates, as those tend to go on for much longer than OS updates with Android.
With a little care, it is likely to be fine.
Those two are the apps that survived the longest (Try getting any matrix client to work on it). Others broke sooner, most of them because the app developer has to enable TLS1.2 to be able to use it for HTTP APIs and many web servers disabled responding to older versions a while ago. Firefox (the one which allowed all extensions) still works. Great! But I can't message anyone anymore. On a phone.
TBH I put most of the blame here on app developers (supporting older stuff is not that hard) and some of it on the device manufacturers.
A complete reset solves it tho.
https://www.microsoft.com/en-us/security/blog/2020/10/08/sop...
In the article it explains how Google and the ransomers are doing a cat and mouse thing. If your phone is not keeping up, that could definitely be an issue.