The max time anyone should keep a phone is when Apple no longer is maintaining the OS version for that phone. That’s usually one major version from whatever the latest happens to be. Beyond that you’re risking your own online security. Too far back and the device likely lacks even the necessary certificates to access much securely. The more and more we move to SSL for everything more important it is to update the software.