Software vulnerabilities that aren't (and never will be) patched.

Anything with any computing power an internet connection can be a target. It will likely become a part of a bot net used to ddos, spam, or crack passwords. In addition, it'll give hackers access to any accounts you're logged in to, such as apple ID, email bank etc, so it could be further used to steal your identity or money.

Because it's so old and full of vulnerabilities, it makes it an easy target. If it gets hacked, it'll most likely be automatic process, without any intervention from the hacker, and there may be no signs that the device is infected.

Devices that are no longer supported and kept up to date with security updates contain known, but unpatched, vulnerabilities. Some of them are software based, but some are a function of the hardware itself. Connect these to a network, manage to do something that gets them compromised, and you've given bad actors a foothold on your network.

Because most networks, especially home networks, tend to be configured in a way that trusts local network traffic more than external traffic, such a foothold can further compromise your systems. Very few people have the resources, or technical know-how to properly segregate potentially dangerous or vulnerable devices on a network.

That's what.