missing-root Vanadium on end-of-life devices without security updates is not a secure browser and neither is anything else. There are known, remotely exploitable vulnerabilities in the GPU driver and other components. Vanadium does not make you safe on an end-of-life device. You shouldn't use any web browser on an end-of-life device, regardless of whether the device has a legacy release of GrapheneOS release and current Vanadium.
So yeah, I think it is important to know what exact threat you are fearing. And tbh I dont know statistics on "how do Android users get viruses" mainly as I never hear of a single case. And if it was, it was paid, police, states, ...
You're completely wrong about this.There are widespread in-the-wild exploits. There's even a lot of in-the-wild exploitation of zero day vulnerabilities. We're not talking about zero day exploits here but rather exploiting over year old vulnerabilities in firmware, drivers, etc. The device also lacks a lot of the later hardware, firmware and software security improvements. Pixel 6 and later were always in a higher class of security and the Pixel 8 and later are another huge step up to a higher of security with GrapheneOS. They still shouldn't be used once they're end-of-life after their minimum 7 years of support from launch ends.