There are enough zero-day RCE exploits on both Android and iOS devices at this point that, if you're running phones that are that far out of date from security updates, you should basically just assume your device is fully compromised.
As stated above, many of the RCE exploits don't even involve any user interaction, so it's not like you can argue "well, I don't visit sketchy websites so I'm fine".