Opinions on buying an old unsupported android phone?

Say I'd buy a galaxy S7 thats no longer supported or even an S8 that soon will be unsupported and don't plan to use a custom ROM.
How bad would that actually be?

I know it'll lack security patches, but how risky is that?

Custom image.

Security risks in android and _all_ other mobile OSes are severe.

Be it Apple, Android or whatever tickles ya fetish.

Attacks can be focused on any part / app of an smartphone - many attack vectors, muey fuckity.

A non conclusive list:
- SMS / MMS (e.g. SMS of death)
- Web (and everything included in Web)
- App Permissions (e.g. sharing contact lists because of lack of permission system for every App)
- Bluetooth / NFC / ... (Anything that connects to external devices has flaws)
- Camera
-...

A part of it requires your participation... Everyone who says now: I would never do that. Be realistic please. Everyone has this one moment every now and then where brain says: beep and hand pushed the Ok button... Realizing 3 secs later that this was beyond stupid.

If you put the handy in a lead box, connect it with an external USB cable which doesn't compromise the isolation of the lead box and the connector leads to a secure PC in an isolated environment ... Yeah. Maybe that's secure.

But pretty non mobile ;)

Let's not ignore the user-to-root or userspace-to-kernelspace security issues.

As those are usually kernel or baseband issues, third party images often won't fix it.

thanks much.
@iiii voiding warranty and possibly not all features working. That makes a Custom ROM not my preferred Option or at least not straight after buying

@iiii depends where you buy it.
refurbed.de seems to have 12 or sometimes even 24 month of warranty. Dunno how much would break in such a phone that this warranty will cover, but still.

@Jedidja Read the warranty details.

Also just because vendors claim the warranty will be void, it might not be legal (depends on jurisdiction).