But no security updates for the OS though which often means you kinda should think about to stop using it for more than an alarm clock, podcasts and spotify.
Most crucial things are in Play Services anyway. I’m not saying that it’s no issue at all but it’s also far from as bad as some make it out to be.
Play Services will still update the web renderer and such. Those are the most crucial updates. It’s not Armageddon when the OEM stops updating their Android base.
Not so quick, you can’t say with any logic that OS and security updates aren’t FAR more important than a web renderer. Exploits are regularly found that go back multiple OS versions all the time. Not getting an OS update isn’t the end of the world, but when a phone no longer gets security patches, time to replace it.
The web is usually the prime attack vector, therefore updates to the web renderer are the most important. Many other features are in Play Services as well.