I am running an Android One (ie vanilla Android supported by Google) phone which has Android 8.1. I have unlocked the bootloader and rooted my device.
Because I've rooted my device I have not been able to apply "System Updates" to my phone for close to a year. Revisiting the available versions I see new versions are Android 9, and will require a full reinstall.
I realised I really like my system as is and dont want to make any changes and indeed I'm concerned of the possibility of some cool functionality may be disabled (like ability to change MAC address, ability to stop charging phone at a preset level).
From a security POV, what are the real risks of running on an outdated version of Android 8.1, assuming I am judicious about the Apps I install and don't go clicking on adverts/spam?