The most significant points, as I recall:

• Catch 22 between security updates and staying offline
• Not knowing what potential malware is already on your old phone
• Not knowing if the manufacturer built in backdoor access for governments

What's interesting to me, is that these all seem like issues for any storage device (at least for people who aren't tech experts).