Don't forget proprietary security patches are only open sourced 3 months after -- GOS has them due to their partnership with Motorola.

A sufficiently motivated threat actor will have them (the exploits) too.

Unless you are using the most expensive flagship of a few Android brands, you are also vulnerable anyways

It's optional.