How do I use an old Android tablet?

You have to make trade-offs between usability and security. There are two types of android security patch level. The patch level 01 contains patches to the android framework and patch level 05 contains vendor patches for the Linux kernel, drivers and firmwares.

While custom ROMs deliver 01 patch level, 05 patch level can be only delivered by OEMs. Your device becomes vulnerable to unpatched vulnerabilities that have been discovered since your device was last updated. If your threat model is minimal and you are only using your device for general purpose, it is still safe to use it as long as you are not installing apps from unknown sources. That's because using only Play Store to install apps significantly decreases your attack vector.

Google removes apps with known malware samples at submission time alone. Some unpopular apps manage to evade detection for months and some innocent apps are later updated to become malicious. See, Barcode Scanner app on Google Play infects 10 million users with one update. If you are using reputed apps, it is unlikely you will ever witness such malicious apps that you can't remove. Although, it's still a possibility but this is where you have to make a trade off. Most of the malicious apps that were found on Play Store were malvertisers that were violating Google ads policies and not exploiting any vulnerability.

Besides, Google Play Protect runs a safety check on apps from the Google Play Store before you download them. It checks your device for potentially harmful apps from other sources as well. It also warns you about any detected potentially harmful apps found, and removes known harmful apps from your device. So you still have some anti-virus like protection even if you are not getting security updates.

In 2020, Over 400 code flaws unearthed in Qualcomm’s DSP chips for smartphones | DEFCON. This can definitely compromise your device upto root. No exploit has been seen in the wild exploiting DSP. Critical vulnerabilities in Bluetooth & Wifi firmware and driver are often discovered. Even with custom ROM security updates, they can't be fixed. This is another trade off you have to make.

Unlocked bootloader cannot protect you against physical access to the device. Root access has no impact on device security, you just have to be more responsible about the apps you grant root access to. When using custom ROM, you have to be precautious about whether SELinux is enforcing or permissive. Permissive doesn't block process for violating SELinux policies, only reports them. There is already an exploit to gain root in SELinux permissive mode | Explanation.

Your device is not officially Treble supported but it has custom support of Treble with custom Generic System Image (GSI). You should use that. GSI gets permanent updates but you won't be getting vendor patches.

Use your old tablet to display a constantly changing slideshow of your favorite photos. Place it on a shelf or desk and relive your precious memories. You can even set it to sync with your online photo albums for fresh content.