I still dont understand /e/OS. Just use LineageOS. It supports all the same devices and doesnt lag as far behind. You can choose to run an insecure OS if you like (see: all Windows 10 users) but definitely don't recommend it to others.

You cannot have privacy without at least basic security. Targeted attacks are not the most common kind of attack by long shot. Threat actors scan for vulnerable devices and use automated scripts to execute attacks. Android is one of the most exploited targets. With an outdated OS your browser could be exploited and used to get a sandbox escape, possibly chaining it into root escalation. It all depends on the vulnerabilities found and the longer you wait the more likely for the "stars to align" for the perfect attack. Look at CVE-2025-48593 for an example, zero-click RCE. In recent memory there was also a zero-click RCE utilizing specially crafted MMS, meaning an threat actor could send messages to all phone numbers and try the attack in mass.

/e/OS is by far the most behind on updating security patch levels of the AOSP ROMs (at ~2 months), iode is ~1 and everything else is better than those two.

Privacy without security is not real privacy, it is a mirage.

Security without privacy is like a fortress with cameras inside, a known threat (eg. Gapps Android).

Privacy with security is like a fortess with no known threats at all (eg. AOSP with timely security patches).

Privacy without security is like a fortress where all some of the locks have rusted through and if someone tries they can open the doors. It is like replacing the walls with cardboard. "No one can spy on me now" you say in your cardboard castle.