Ask Lemmy

The danger is essentially that anything being done on the phone is not secure.

If all she does with the phone is look at cat pictures and talk to friends and family, there's probably not much critical information there to worry about.

But does she use the phone for banking? tax records? health care? Does she use the phone for multifactor authentication to log in to her bank account &etc?

Anything involving financial or personal information could be used for identity theft and fraud. Even if she doesn't have much money personally, her identity has value on the black market for opening fraudulent credit cards and other accounts. If her phone is no longer getting security updates then her email may be exposed, and basically if you can get into someone's email then you can get into all of their other accounts (through "I forgot my password" links). Also keep in mind that the phone is a tracking device, so if it's not secure then anyone with the time and interest could use it to track her location.

It's worth noting that switching the phone to another OS like Lineage may not solve this problem. Android uses a core security feature of ARM processors called TrustZone to handle cryptographic functions like security keys. This depends on processor microcode that only gets updated by the manufacturer. If the device is no longer supported, then it will probably stop receiving updates. A third-party developer like Lineage won't have the capability to update this code.

The potential threat from this is not usually immediate. Just because a device might be vulnerable doesn't mean that it's worth anyone's time to actually hack it. But frequently what happens is that someone finds a vulnerability that can be exploited and then builds some software that can do the necessary steps automatically, after which any device with that vulnerability is not secure at all.

Deciding how critical all of this is for your mother depends a lot on context. Does she have financial assets that might make her a target? Is she politically active? Is she a member of a sociopolitical group that might be a target? Does she have a social media account with a lot followers? Does she have any close friends or relatives that someone might want to target through her? Does she know anyone who works in security for a large corporation, government or bank? Her own vulnerability might make someone else vulnerable by proximity.

There's no way to eliminate risk completely. The only way to answer the question "how dangerous is this?" is to assess the severity of possible losses and the likelihood of potential threats (threat modeling) and then make judgment calls based on priority.