All software is full of security bugs, supported or not. While supported SW fixes known security bugs it also introduces new ones. Therefore it doesn't matter much, it's all vulnerable.

Security patches are also increasingly misused by the vendors to push unwanted crap.

Other security approaches are needed: firewall, updated browser + adblocker, not clicking on everything, doing research before installing stuff, etc.