Messaging, web browser, podcasts, navigation, a couple services that require a phone to access. I tend to not install apps that could be websites.

Hardware drivers are surely dated. Android, on the other hand is 15, and I assume getting updated to 16 soon. I think I'm pretty good with regard to the sort of zero-click exploits I've heard of used for targeted attacks. If somebody slipped a trojan into a software update, I could have a problem, especially if it was a privileged app like AccA or Adaway. Of course, updated drivers wouldn't protect me from that.