When you do that you're also buying into a phone that will stop receiving security updates sooner since iPhones receive updates for ~5 years after they're released.
I wouldn’t really worry about that. Apple has been very good at giving security patches to old devices. Just a few days ago they pushed a security patch for iPhones as old as the 5S