iMac too old to upgrade, is there a security risk?

If you are currently only using Safari, then you may need to start using a third party browser such as Firefox, Google Chrome, or Vivaldi since Safari is no longer receiving updates and the Internet changes daily so at some point Safari will no longer load some web pages.

Once you feel macOS is no longer working or secure enough for you, then you may want to consider replacing macOS with a Linux OS. You will need to learn a new OS, but you will at least have an up to date OS which can use the common web browsers (Firefox, Google Chrome, Vivaldi, and maybe some others) plus it includes access to lots of free open source software including LibreOffice to name just one app. You can usually test out a Linux OS from the Linux Live USB installers without affecting the current macOS although the Linux performance will be very slow while booted from a USB stick. I would suggest using Linux Mint as it is easy to install and should just work on a Mac, but one of the Ubuntu flavors such as Kubuntu or Ubuntu-MATE should be Ok as well for an older Mac. Just make sure any important files from your Mac are transferred to external media that can be accessed from any non-Apple OS. Plus make sure to create and test a bootable macOS USB installer in case you decide you don't like Linux and want to go back to macOS since Internet Recovery Mode doesn't always work for some people. Linux is not for everyone, but your stated work load would appear to be a perfect match for a new Linux user.

As long as you're behind a router you're pretty safe. Besides the suggestions in the "Effective Defenses" user tip you could do your random web browsing from an non-administrative user account.

You're biggest concern would be adware and malware. download and occasionally run the free version of Malwarebytes. It was developed by a long time contributor to these forums and a highly respected member of the computer security community. That's abut it.

Hello, Beckrich.

The security risk comes from the inability to patch any potential security holes in the OS, the web browser, the network hardware/software/firmware, etc. With best practices you can minimize the risks, but since the device and the OS are no longer supported by Apple, you won't be receiving any fixes for anything that might be discovered.

Here's some light reading if you're at all interested:

click> Effective Defenses Against Malware (John Galt)- Apple Community

click> How to install adware (John Galt)- Apple Community

click> Avoid phishing emails, fake 'virus' alerts…and other scams - Apple Support

click> Viruses, Trojans, Malware - and other aspects of Internet Security (Klaus1) - Apple Community 

All computers are at some sort of risk, and that risk likely increases with age. It's a judgement call if your habits are risky or not. If it were my machine and running well, I'd have disaster plan and keep using it. Often times it's not how severe the risk is that matters, it's your ability to fully recover that's important.

You might not want to keep sensitive documents on it if it's internet active, but that's your call too.

+1 👍🏽