Zero-days, by definition, tend to target the newest software versions because they're novel. Zero-days still work on older software versions but are instead just exploits or "n-days".
Don't think you're safe just because you're only streaming music. The last security update for 18.4.1, for example:
Again, is it likely? No.
Going with the referenced commenter's statement, it would be more like
Also, do people do anything to mitigate the risk of driving less safe vehicles? I think most people would drive the exact same, assuming it's a similar car shape and size (e.g., sedan compared to sedan).
But while I wouldn't run an obsolete device, I wouldn't worry too much about your device being hacked as an entry point into your home network. Your router would probably be hacked first. For those who forgot:
https://arstechnica.com/security/20...net-went-undetected-for-four-years-until-now/ You don't have to
do anything risky on an internet-connected device to be hacked; being connected to the internet is itself risky. I don't think people are visiting sketchy websites on their NAS, but that didn't help. As for not responding to sketchy messages, you don't have to respond to messages to be hacked—for example, the infamous Pegasus hacks.
If you want a concrete action rather than the generic and somewhat useless "be careful", the above article has a good one: Regularly restart your old devices. Not all malware is persistent, especially so on iOS which has verified boot.