This is actually a difficult question to answer with any confidence.
However, it's also a question that more often than not answers itself eventually.
Become a Patron of Ask Leo! and go ad-free!
Risks low for most
On one hand, I believe the risk is low in general. While both iPhone- and Android-based mobile phones are targets, and more current operating system versions are more secure, my belief is for most people it's not really as big a deal as one might think.
It's the "most people" part that makes this hard to answer.
Most people's use of their devices is relatively stagnant. By that I mean they use a few apps consistently, but don't stray far from what they've been doing for as long as they've had the phone. They're not downloading random apps that could pose a risk. The sites and services they use are well known and well established.
If that's the case for you, there may not really be a huge benefit to an upgrade, other than getting a newer and faster phone 
.
If you're not "most people"
If you're a power user -- if you regularly try out new things on your device, have dozens or hundreds of apps installed, and surf the internet with reckless abandon -- then making sure you've got the most recent security updates makes more sense.
And at some point, that probably means getting a newer phone that has the newer operating system with all the newer bells and whistles, including security updates.
"Most people"
If you're not a power user but don't have a good sense of what it means to use the internet and connected services safely, then taking extra steps to stay safe make sense.
Honestly, this is similar to the answer I give to someone staying with Windows 7 or even Windows XP on their PC. It's on you. If your habits and usage fall into the "generally safe" category, you're probably fine saving your money and continuing to use the device you have.
I believe most people fall into this category, particularly when it comes to mobile devices. They use their phones for what they use their phones for, and tend not to experiment or add much to their mix. For these folks, an upgrade probably isn't required.
In your case, adding a security suite of some sort is an added argument in favor of staying where you are.
The problem solves itself
Ultimately, I think this problem solves itself eventually.
The number of people who are able to keep a phone working past that three-year (or however many year) window of support are probably few. Be it phones that get dropped, batteries that wear out, or phones that ultimately don't have the power to keep up with the latest versions of the tools people use, I suspect a lot of people end up upgrading for a variety of reasons not related to security.
In your shoes, I'd probably keep on keeping on until something else causes me to need to upgrade.
Do this
Subscribe to Confident Computing! Less frustration and more confidence, solutions, answers, and tips in your inbox every week.
I'll see you there!
I have a Galaxie NoteII 4GLTE Model # T889. A week or so ago I got to where I could not get my email on it. I had always use ATT/Yahoo email. I haven’t been able to find how I could upgrade it or get a new app, etc. I took it to ATT for them check and they ended up deleting my ATT/Yahoo email and told me to use Google and I wonder if anyone has any idea how I could fix this problem. Everything else works on it. I could never get google to work. Any ideas will be appreciated as I don’t want to have to buy a new phone. Thanks
I owned my first phone, a flip phone, for years and years. Same with my second phone. When I replaced it about 3+ years ago, I gave it to my then 10 year old grandson (WIFI only) to play games on. He still uses it. I’ve had my current phone (only my third) for over three years and will use it for years to come.
Clearly, I’m not a phone power user. But, the real secret to keeping your phone is 1) a good case and 2) always buy one with a user replaceable battery. They are getting harder to find and I had to look a little this last time but it makes all the difference. When the phone gets slow or cannot hold a charge, just slap in a new battery. On mine it takes about 30 seconds. My phone currently goes two days on a charge, as old as it is.
I still have and use daily my iphone 4s! Its small, fits my hand and my pocket, still holds a charge, does what I need; email, text, internet…oh yeah…I can even make “phone calls!” Lets see, 4s dates back to 2011, picked mine up in 12, 7 years and counting. Wife has to have latest/greatest…says I’m in the Twilight-Zone! Just can’t wrap my head around carrying an $800 plus phone. As for security, I’ve never had a problem. It gets slow on occasions so I just dump and reload from my backup and it just keeps on keeping on!
The only thing I really use my phone for is the authentication apps (Google, Microsoft and Lastpass). Most of the other stuff I can do without. I have a LG phone from Comcast using Android version 7.0. And, yes, i have multiple ways of authenticating log-ins if the phone isn’t available.
What wasn’t mentioned was apps start falling behind. They get updated for newer versions of the OS that doesn’t work on older versions. I have a MS 950 w10 phone .Apps are disappearing,and when the W10 is updated( yes they still update) the app stops working.
I recently dropped my budget Samsung J5. Buying a new phone, with a more recent android version (and up-to-date with security updates), seems the logical thing to do.
However, as I found out, new is not always better. For instance take a feature like Call Recording. Google (as many more big US companies) knows what’s best for us and impose their will by removing this possibility in android 9.
I really wished that Windows Mobile had conquered a part of the mobile market…
I believe the feature, such as it was, was removed because it could be abused by malware. So the removal wasn’t capricious, but rather a security issue.
New post on an old thread! Lol!
I’ve got a Samsung Galaxy S7 Edge that I bought used, and have been using it for about 3 or so years now. It no longer gets updates but it’s plenty fast for what I do, and has more than enough storage for me. Battery life is still good as well.
All I really use my phone for is texting, calls, looking stuff up, and occasionally Google maps. I don’t even have Facebook. So for me to lay out a bunch of cash on a new device would be like flushing my money down the toilet. I like it, it works great, I’m keeping it! Lol