Sorry for being too frank, your answer is a big YES, it shouldn't be used anymore - at least it shouldn't be connected to the net if you don't wanna change your device. It's twenty-first century and we're living in the age of IoT (Internet of Things). Security, is the most important thing in everyone's life since what we are dealing with - daily, hourly or secondly - is DATA! And most of those people not working a lot with Computers, are keeping their Data in their smartphone!
Updates are not only meant for more compatibility with newer applications with new enhancements, they are meant to patch vulnerabilities, pitfalls, and security breaches. When vulnerabilities don't get patched, attackers can easily use them as your weak-point, to access to your Data, you data will lead them through your life, your life can even mean your house if you have a smart house! Afterwards it will lead them to gain access to other's lives whom are in relation with you, and so on!!! It's like a tree with thousands of branches. One master card means thousands of master cards - if the attacker who has gained access to yours is an expert!
On the other hand, consider someone willing to hack a governmental agency, or an organization, or etc., they can hide and cover their tracks behind yours, they can throw you in trouble to escape from trouble.
Being up tp date, means safety, not only yours, but also your loved ones. Please consider being up to date a serious thing.
I'm a Linux System Administrator and System Architect responsible for System-Level Security for such things - I should test things sometimes as a penetration tester, so I'm not exaggerating, I've seen all those I mentioned.
If you need an example:
Dirty COW (Dirty copy-on-write) is a computer security vulnerability for the Linux kernel that affects all Linux-based
operating systems including Android. It is a local privilege
escalation bug that exploits a race condition in the implementation of
the copy-on-write mechanism in the kernel's memory-management
subsystem. The vulnerability was discovered by Phil Oester. Because of
the race condition, with the right timing, a local attacker can
exploit the copy-on-write mechanism to turn a read-only mapping of a
file into a writable mapping. Although it is a local privilege
escalation bug, remote attackers can use it in conjunction with other
exploits that allow remote execution of non-privileged code to achieve
remote root access on a computer. The attack itself does not leave
traces in the system log. It has been demonstrated that the bug can be
utilized to root any Android device up to Android version 7.
The bug has been lurking in the Linux kernel since version 2.6.22
released in September 2007, and there is information about been
actively exploited at least since October 2016. The bug has been
patched in Linux kernel versions 4.8.3, 4.7.9, 4.4.26 and newer.
N.B. I recommend you use 4.9 if you're a linux user.
You can check the following link to find the codes and further information:
By the way, it makes no odds if you're using smartphone or a computer to keep your data in, the only thing matters is that your keeping your data, even your sensitive data sometimes. Either your smartphone and Computer have something called OS that are running atop something called Kernel! What would it be if kernel never gets newer updates? Kaboom! Compromised, no matter if you are an important person or a normal guy, you'll be compromised because your address - IP, MAC, Device anything, - will be considered as either a bait, or an aim.