Regged phone

Additional to Jasons correct explanation: It also depends how / where they are used.

Example: 

If you use them restricted to only be connected to an internal network without connection to the internet (which is often the case in warehouses) it doesn't matter. And sometimes this network is additionally isolated to other networks so the security risk is again very less.
It maybe a problem if apps used and needs updates (for some reason) require latest Android but as Jason said those rugged devices sometimes have a longer update support (depends on the manufacturer, especially the enterprise manufacturers like Zebra, Honeywell and many more).
Example: Zebra TC51 was released in 2016 and latest Android is 8.1 but still gets from time to time security patches. So, it's a seven years old enterprise device still getting updates (but not sure how long it will continue and was just an example).

For sure if the devices are used with (free) internet connection and Android (security) patches are not applied any more (or running out soon), you should look for a replacement (or even don't buy them).