iPhone XS

What happens when updates stop

The phone keeps working. What changes is that newly discovered vulnerabilities stop being patched, so publicly documented flaws become permanent ones on your device. The practical risk builds slowly rather than arriving on a particular day — but it only ever builds.

If you keep using an unsupported phone, the sensible mitigations are to move banking and payment apps to a supported device, avoid storing passwords on it, and keep apps themselves updated for as long as the app store still serves them.