Remove the romance element from it.
If the bottle spins, someone has to spend time in your company doing something you enjoy. You and your friends all agree. The bottle lands on you, and suddenly whatever it was you enjoy is not just "unenjoyable" but is actively repulsive to the other people. Ironically, I'd expect people to be repulsed by having to do half my hobbies, so this isn't a perfect reframing.
Apologies if I'm not being sensitive to your thought patterns. But there must be a way of reframing this that you can see why someone would be upset that their "friends" find them actively repulsive to even be around.
So... go lookup the CVEs. Go have a look at what the actual threats against the old device are. What's the method of attack and do you care.
If you decide you're happy with the device. Then remember to keep going back and seeing if any new attacks against the device exist.
Whatever happens, we're not protected against 0day attacks (by their very nature).
I guess there is some reason to worry about "unknown" attacks against the device. But like 0day's, there's probably unknown attacks against patched devices as well.