By coincidence I had to get an old device running last night because current device is broken. I was able to flash 2023-09-05 Android security updates atop a 2014 phone whose last firmware update was 2016-09-01. Is the device not safe? To some extent yes, but I was able to keep an old emergency device running with security patches from last month which is better than having to buy a new temporary device or being stuck on the matching official 2016 ROM.