Hi! I am a security researcher learning Android, and the system is even more robust than you describe. Not only are applications maintained separately once you lose vendor support, but mainline modules continue to provide updates to commonly targeted omponents. Stagefright type bugs are highly unlikely because if such a bug was found, Google can and does simply update the media module irrespective of vendor support.
It’s more accurate to say that when you lose security updates you are now getting a reduced selection of patches. You correctly identify that firmware for some components is not going to be updated anymore. There is definitely an increased risk, but it’s also incorrect to claim that you’re not getting any security updates.
I don’t advise intentionally running software with known security vulnerabilities. Some vulnerabilities will be patched, but not all, if your device no longer receives security updates from the vendor.