The takeaway here is that if you have a device that's so old it's not supported for iOS 10 updates, it's a doorstop.
The iPhone 4S was an extreme case of this, where it was introduced in 2011, but was sold in India until 2016. Meaning it has some of the shortest or longest iOS support depending on when and where you bought it (0-5 years!)
5-10 years personally is what I think the minimum should be for security-related bugs.
Fact is, I'm probably never going to hold off on a phone for more than a year (I still have a 6S+), but I always hand-down my old phones. I can't use a 5-year old phone, but, others can and should still be able to do so safely.
Why weren't you happy with an old Nokia?