I think only core OS vulnerabilities (kernel plus a few libraries) are not updated. 9 times of 10 these are local privilege escalation that are less important if you don't run random apps.

Depending on the Android version, most other things could be updated in other ways (security updates from OEM, system updates via play services, app updates including system apps via play store).

On top of that, you can add local and network firewalls and similar stuff to harden the system.

Basically, probably good enough for the intended usage.