Nothing to worry about if you are smart about where you go on the internet, keep your web browser up-to-date and use a router with a firewall protecting the Mac. I don't quite agree that you should need to worry about messing with your Mac too much with OpenCore and whatnot - that's kind of like intensely worrying about the resilience of a safe in your closet while the front door to your house has a broken lock.
Operating system patching is the inner ring of a multi-layered defense strategy. If a cyberattack successfully penetrates down to the OS level, then you have some fundamental issues with your overall security strategy and practices, most notably on the outer layers. If patching the OS is an option then you should certainly do it, of course - you don't want to give attackers even an inch of potential surface, but if the insecure device has properly hardened layers of security surrounding it then your risk is actually extremely low.
In cybersecurity, if there is a mission-critical system that is insecure, unfixable and yet irreplaceable, you implement strategies called compensating controls to cover those vulnerabilities by alternative means. In this case you might consider treating the CMP like an insecure IoT device and add a smart firewall device such as an Eero, Trend Micro's Home Network Security or BitDefender Box 2 between your modem and router. These will block malicious domains and code before they even enter your home network, much less reach your Mac to execute their payload.
Longview: to successfully attack a CMP that has layered protection as described above, a cyberattack would need to penetrate all of the following:
* Layer 0 > Your internet street smarts (not getting phished, not visiting sketchy websites, etc.)
* Edge layer > Smart Firewall device with an active security subscription (very difficult to compromise)
* Middle layer > Up-to-date Web Browser (would probably need to be a zero-day exploit to get past this)
* Inner layer > Xprotect definitions vs malicious execuable code (Apple still updates these even for unsupported macOS versions)
* Core layer > unpatched Operating System vulnerabilities
In summary, if a cyberattack successfully penetrated all those layers and compromised your CMP, then congratulations - you were probably targeted by a state-sponsored attacker who was paid a lot of money to do so.
