I'm a bit late to this game, but as I do cyber security consulting, I figured it would worthwhile to jump into this thread as the only one to reply who seems to have knowledge of the actual security implications to an individual of not updating your phone.
I'll give away my policy right at the front: I never keep a phone past its end of life. Part of the reason I buy iPhone over Android is the longer lifespan. Usually my phone dies before Apple stops updating it, forcing me to buy a new phone. But when my wife had her phone long enough for Apple to stop updating it, we tossed it and got her a new one.
What is the real risk to having an unpatched phone - specifically an android phone? The overwhelming majority of cyber attacks fall in the "spray and pray" category. An attacker creates an attack that takes advantage of some vulnerability and then just puts it out into the world and waits for something to hit back. This could be an advertisement, it could be a nasty website, it could come through email, or it could just hit your phone when you're out in the world connected to some random wifi. These attacks are laughably ineffective. 99.999999% of attempts fail - usually because whatever machine they're trying to get at is either patched against the attack or isn't reachable. This is more true on cell phones, where application sandboxing means one app cannot interact with another app unless you specifically allow it (the most common method of compromising a cell phone is through an application or an advertisement displayed by an application). Even then, those interactions are usually happening on the backend, so if your Chrome app is compromised it can't reach out to your mail app or finance application.
Android was actually late to the game on Sandboxing (mostly because it made advertising less effective) but if you've bought a phone in the relatively recent past your phone is relatively safe from bad apps or compromise.
That being said, the holy grail of smart phone cyber attacks is getting around that sandboxing and it happens with some regularity. Someone will find a way to get from a text message to the backend of the phone and suddenly they've "jail broken" your phone and can get to anything they want. Or someone creates an app that has a way to get around asking for permissions, or something else. There's always a more clever person figuring out ways to get around the security inbuilt to your phone. Google, Apple, Microsoft, et al spend hundreds of millions (and sometimes billions) of dollars a year paying hackers to find these exploits and tell them about them so they can fix it. It's called bug bounty programs and a subset of individuals make an extremely good living doing it.
Because of bug bounties, it's not super common to find a major exploit out in the wild without the manufacturer already knowing about it. They are out there though. As lucrative as bounty hunting is, it is still more lucrative to be a hacker and they're always going to be more clever than the rest of us. Still, the worst attacks against cell phones are usually announced after a patch has been released.
All of that background was build up for this next part: within 24-72 hours after a patch is announced for a vulnerability, hackers are sending out spray and pray attacks for that vulnerability. And while most of their attacks are unsuccessful, the successful ones come from individuals with unpatched systems.
Now, hacking a phone is not the same as hacking a computer. With a computer, Ransomware allows you to lock the user out of their machine and forces you to pay them to get access to your computer back. That doesn't work on cell phones because of sandboxing. So instead they use their malware to steal data like usernames and passwords from cell phones.
For most people, their phone is the center of their lives. Netflix, Amazon, Food apps, shopping apps, travel apps, credit cards, email...everything lives on that phone. Even if you do not access your bank from the app, if you use your email to access anything (banks, Amazon, Netflix, whatever) hackers will use access to your email to get into everything else. For instance, if I have your email, I don't need your user/pass for your bank account. Old emails will tell me the username and your email will give me everything I need to change the password. And not just bank accounts, access to email is all anyone needs to gain access to pretty much everything you and she have (unless you are one of those extremely unusual people who create a unique email for each login). If not, your bank account or paypal or venmo are at risk. Or if its just Netflix, there is an entire industry where folks steal Netflix accounts and resell them. Or Amazon, there are industries built around gaining access to Amazon accounts and using the account to buy the hackers garbage stolen stuff. Or airline and hotel travel points, or just about anything that can be used to buy something.
There are more, for as good as I am at my job, hackers are much more creative than I will ever be.
So to try and summarize, are you in any immediate danger the day after your last security update? No, not really. The risk at that point is very low. But every day you run the risk of a new attack being announced - either because it was discovered by a hacker or it was announced by Google with their latest round of patching. And from that point on you a playing risky game. Every new app you download or wifi you connect too or place you go puts you at risk of losing out on a lot.
So, yes, I would strongly advise you to buy a new cell phone once patching ends for your current model. If you are bothered by having to replace a phone every 4 years, consider making the leap to Apple where you can squeeze as much as 8 years out of a phone (and by that time, it's probably about dead anyway).
Smart phones are the center of our entire world. They are attached to everything we do, and people are not well versed enough to understand the actual risk they pose to their lives if access to the phone or the information on it gets into the wrong hands.
