1000/400 mbps down/up for 40€ /month. Portugal

I’d know if someone had any access to my phone

This is really a bold claim. How or why makes you so sure of that?

If the attacker/app manages to get some application running in the background as root, how would you know that they had access to your phone?

Am I naïve for thinking that manufacturers stopping support for devices, then claiming it affects your safety, is just to sell more phones?

Yes you are.

Vulnerabilities are constantly being found in the software stack used by Android, if you are running vulnerable software you’re increasing the likelihood of some malicious app (or website, file, etc…) taking advantage of the vulnerability. The consequences of vulnerability vary from being able to fingerprint your device when it’s not supposed, to escalateling privileges to root or even kernel mode. Although the later are significantly rarer.

and had zero security issues in a dozen years

That you know of… If the vulnerability is successfully exploited, the likelihood of you noticing are close to zero.

You could always flash a custom ROM to install the latest security patches, but you would still be missing the security updates for all the closed source components (such as the bootloader, device drivers, etc…). Not to mention all the security implications (good or bad) that comes with installing custom ROMs.