What about personal data such as photos, real-time position data, phone numbers, phone logs, private messages, email and so on? Getting access to email allows a hacker to reset passwords to most services you have signed up for. Even if you like most people have nothing to hide, it's a big headache to recover access to services and it can take a lot of time and effort. As for phone numbers, if hackers get a hold of your entire contact list, your can bet all those people are going to receive scam phonecalls. Maybe just once or twice, or maybe several per day.
Then it's the bigger issue of botnets. If we are ever going to get rid of those, we can't have devices with known security problems that allow hackers to take them over and turn them into botnet peers.
Also, when you bring an infected device into someone's wifi network hackers can get access to other stuff on that network. When if you don't have anything critical doesn't mean others don't, and by running outdated software you are putting others at risk.
Security updates are important. It's not wise to leave known security holes unfixed because "there's noting critical on this device".
However that would probably require apple to modify the ipsw file since that agreement appears directly on the device during setup and is not fetched remotely by iTunes afaik
