When any device stops getting operating system updates, it is no longer protected by the manufacturer’s active monitoring and fixing of security vulnerabilities.
Severe security vulnerabilities, some of which even allow attackers to take full control of the device, are regularly discovered in all devices and operating systems. Apple is no exception. Attacks originate from many sources: websites, over wifi, plugged in devices, etc. Many of these known issues are publicly documented, some are not.
Having said that, Apple products are generally relatively tough, due to a combination of hardware and software features. Because your device is old, some newly discovered vulnerabilities may not to apply to you. Generally, “black hat” security researchers tend to focus their attention on the most popular, most vulnerable targets. Your old iPad may be different enough from the latest devices that they are not a sensible target for expensive research. It is, however, still possible that new vulnerabilities are discovered that can be exploited on your device.
Overall I would say the risk is relatively low, but if I were you I would not:
- use it for purchases
- store or access sensitive data on it (banking, etc)
- log into accounts without 2FA
- connect to public wifi
- visit websites known for unscrupulous security practices (warez, porn, etc)
It’s also a good idea to use a strong wifi password, and keep other devices on the network up to date, which will protect the old iPad somewhat.
Hope this helps.