I do understand that newer Android versions incorporate the bug fixes that were found in older versions. But their main purpose as far as I can tell is introducing new features (i.e. bugs) of their own. Android 7 is also not that old as far as this stuff goes. I'm sure lots of people are running even older Android versions on their phone. I still have an Android 2.3 music player (Archos 43) though I don't use it much.

I'm not a heavy user of Android so I tend not to pay too much attention. I'm on a 1GB/month data plan and I usually use less than 1/10th of it, checking email or (in the past) Reddit here or there. The only internet-connected Google app I use much is Maps, though that admittedly is one of the more invasive ones. Is there anything else I should watch out for? I get the impression most vulnerabilities are in apps rather than the OS. Most of my apps are from F-droid and I do keep those updated.