If your android is out of security updates, this won’t be the only thing to worry about, I would probably worry about the easier to exploit ones first.
Not doing so is a disservice to their customers frankly.
They're currently bugging me about updating a 9 year old ipad I just use as a kindle. They flatly blow Google away on device updates, and will continue to do so even if Google isn't lying about their new / supposed 5 year update plan (and NB: that's 5 years from the release date, not 5 years from the last sale date, which could be reasonable.)