Quantifying based on the formula
There is a massive misunderstanding in risk in general, and you are running into this misunderstanding.
That's not a formula!
Risk = Threat x Vulnerability x Information Value describes a relationship between those factors. You are not supposed to drop numbers in there and come out with a quantitative result.
Note that there ...
Unsupported operating systems can have vulnerabilities that have no patch. Over time, that threat grows. That means that it becomes trivial for an attacker to be able to breach the device. A breach of the device means that all data on it is exposed as well as all the accounts (business, email, personal, banking, etc.).
Yes, there is a chance that the OS does ...