Pontifications

If somebody gave me an Android 4.1.2 phone that's no longer being updated post 4.1.2. it's not a good idea to use it right? Because it's vulnerable to every major exploit discovered after Heartbleed i.e. every attack after 4.1.2's release October 2012 right?