I get it about malicious apps but what about just using mainstream apps and surfing the web with adblockers?

Can someone explain to me under what circumstances would using an old phone be risky (under a common reasonable threat model)?

Bro I can’t even convince them to join me on Signal… It even syncs contacts w/ mobile number so it’s just a matter of downloading a stupid app and you’re set… I think one day I’ll be brave enough and just disappear from whatsapp.