When is phone considered insecure due to age?
There's probably no definitive answer to that question, as
@Xavier Black alluded to it's very much a matter of opinion. Security updates and version upgrades are typically determined by your cellular carrier, a company that bases its decisions primarily on profit margin than on their customer's phone security issues. Google can keep pushing out fixes and upgrades but unless your carrier chooses to actually provide any of those fixes to you, the sad fact is you may or my not ever have access to them. You could root your phone but once you do, that puts
all the responsibility of maintaining your phone on you, freeing the manufacturer and/or carrier to arbitrarily deny any warranty claims even when it is a problem on their end.
There's also a matter involving any third-party apps and online services you use on your phone. The apps themselves usually need frequent or at least periodic updates too. Some people opt to avoid updates as they can involve user interface or feature changes, but at the same time they're ignoring the privacy and security issues that can result in continuing to use outdated apps.
There's also a reality that your S5, and any of our phones, are vulnerable in some way to online connectivity. The Internet has devolved into a really hazardous entity, with not just new but long existing exploits being revealed almost daily now so it's not a matter where any smartphone can be made to be 100% 'safe' for daily usage. It really is a matter where it's how you use your phone and how you perceive its vulnerability to being compromised. You could use your phone in Airplane mode, disable WiFi, mobile data, basic cellular connectivity, Bluetooth, NFC, and remove your SIM card, which will essentially prevent any security mishap to affect your phone but that does negate most of its functionality.