If a device isn't getting security updates anymore, it's vulnerable. And a lot of the time these things aren't caught right away. This is the exact same reason why you should never put a computer running Windows XP or 7 on the internet - it's no longer secure and your system can be accessed by any person motivated to do so.
If you don't care, that's another matter. But you're inarguably at a higher level of risk when your system can be exploited in a greater number of ways than one with more recent security patches.