They keep using them.

When no one has met or even heard of anyone who was affected by running an outdated phone OS, they don't care if there's is outdated. Ask most random phone users, regardless of the OS, if their phone has current security updates, and they probably won't know what you're talking about. It doesn't really matter anyway, because your average phone user is far, far, far more likely to give away credentials through social engineering, or to be affect by a third-part data breach, than they are to be affected by the security of the software running on hardware they own.

Most phone security measures are security theater anyway, and state-sponsored organizations get around them with ease, which they only bother with because it is very important that the target not know they're compromised. Thieves stick to social engineering and stolen credit card numbers, because it's the easiest method.

It's no different than your house, where the door lock can be easily picked, but only someone committing a targeted covert break-in is even going to bother with that, because the regular thieves will just break a window.

I agree, people don't care. There are plenty of offers of Android 4 and even Android 2 phones on secondary market here, not to mention more recent Android versions those are still long obsolete. People buy and use those, they are not aware it's an issue. A phone is a phone, it works, why not to use it, right? I personally use a phone that runs alternative LineageOS-based firmware, the updates for this firmware stopped 2 years ago. I suspect there are multiple RCE vulnerabilities either in the OS and in the drivers now, and it bothers be somewhat, but not to the point that would force me to spend money on a new phone yet, exactly for the reason that I've never heard of remote attacks on phones of "ordinary" users who are not activists or, say, politicians.

Off-topic-ish note: Second hand prices where I am are ridiculously high, eg. Samsung S21 Ultra: $595 (although maybe 'the state of the world' is catching up to these high prices, or maybe I'm just a tight c)

Some of the following may be a little bit dangerous if connected to a network, but just make sure that it's a fairly locked down network, ie. fairly heavily restrict and monitor outgoing comms.

- LineageOS and relax

- "In case of emergency" device

- Portable entertainment-only device

- Offline authenticator app

- Offline crypto wallet (dangerous at the best of times)

- Webcam

- Backup 'target'

- Burner / Holiday phone

- Kids hand-me-down phone (duly sanitised)

I have literally never spent a moment worrying about this. How do you even know that this is the case for your phone? If my phone gets security updates, it never tells me about them.

Those who are not that concerned with security will keep using it for a while or possibly look for some third party protection ... those who are worried about up to date security, if they are not able to do so themselves, will take it to a specialist to get something like GrapheneOS (or whatever compatible OS) installed.