Some malicious applications do end up appearing on Google Play. Google tries to block malicious apps from entering, and does remove them from the market after they find, but it's not perfect system (I don't think you could have a 100% perfect vetting system that accepted "good" apps while keeping the "bad" ones, even if you had a human reviewing the source code of each of them).
Just as a sample, here is a piece of news from today talking about a spyware that passed through their filters:
Moreover, while there are some apps that are clearly for no good, there are other that may comply with their terms of service, but contain features you would probably find undesirable, such as tracking your position continuously (unrelated to the goal you expect that app to fulfill), recording your surroundings or scrapping your address book (but people technically agree them to do through their own Terms and services).
OTOH, if you are not installing new apps, and with a bit of care, it could be hard that a malicious app gets installed.
What I would be most concerned would be if there is a vulnerability that could be exploited remotely, such as one on your browser or in the WebView.
Depending on the exact Android version you are, you could also be missing new security features.
The importance of the lack of security updates for an end-user, should mostly depend on the importance the user itself puts on the consequences it could have. And the probability of such risks actually materializing may depend on the actual use, and even the savvyness and attention of the user.