What are possible consequences of not installing updates I've a many-years-old android phone on which I've never updated the OS, never logged in to Google Play.  I haven't had any google accounts for years.  

I deleted nearly all apps that came preinstalled on the phone, and have never installed any apps (other than firefox directly from mozilla, with some privacy plugins/addons).  Further I've never logged into any website (i.e. no email, no banking, no purchasing, etc).  Further, my address phone book doesn't contain any sensiteve contacts, such as my financial institutions.  

I never connect to wifi other than my home.  My online phone activity is limited to checking the weather forecast and reading mainstream newspapers (and that is only at home. I don't have any data on my phone subscription plan).

What harm am I open to?
Even if you don't use the phone for many things you may still get a victim of an attack.

The first security problem are apps that are no longer updated because your Android version is too old and is no longer supported. App updates some times not only add new features but also fix vulnerabilities. Not getting the update can make your device even more vulnerable to attacks.

Especially an up-to-date web browser app and WebView component is crucial, because malware was even found on large well known web sites - or to be precise it was found in advertisements shown on these pages. Nowadays ads are are sold via real-time auctions, therefore the owner of the web page has only limited influence on what ads are being displayed. The ad companies try to prevent such "malvertising" (malware advertising) campaigns but in such a dynamic market you can't filter out 100% and one banner with malware may be enough. 

A second problem may be the Android Media Service which automatically processes every file you download. In history this service has shown dozens of vulnerabilities that enable root access. Now again Google has managed to put some more vulnerabilities in this service. Therefore from my point of view this service is one of the major risks on your device - but you cant disable or remove it and even if you could so apps would stop working like the USB PC connection or the photo album app.

Once an attacker has managed to take over your Android device the attacker can scan your home network for other vulnerable devices such as Smart TVs (often contain microphones), webcams, and so on. Depending what you have installed the effects of an attack can have an significant impact on your life.