termux doesn't use most of the system libraries that are likely to be remotely exploitable, e.g. openssl and webview. the remaining unupdatable weakness is the kernel, but it's pretty unlikely to have a TCP RCE or something like that. there's SACK Panic, but that's only DoS, not RCE, and if you're running something on android 5 you probably have low reliability expectations anyways.