When a security vulnerability is discovered and patched, the patch announcement essentially tells every attacker in the world exactly what the hole was. Security researchers and attackers both read these announcements and both know how to exploit the unfixed version. From patch release to active exploit, the window is often days or hours.
The WannaCry ransomware attack of 2017 crippled the UK's NHS and hundreds of thousands of other systems worldwide. The vulnerability it exploited had been patched by Microsoft two months prior. Every affected system was running an unpatched version.
Turn on automatic updates for your operating system, browser, and apps. Not 'check for updates weekly' — automatic. Your computer can update at 3am while you sleep. Set it and forget it.
This applies to your router too. Routers almost never auto-update. Log into yours once a year, check for firmware updates, and apply them. Router vulnerabilities let attackers intercept everything on your network — every device, every request.
If you're running a computer that can no longer receive updates — Windows 7, old macOS versions — you are running a machine with publicly documented, never-to-be-fixed holes. The safest thing is to stop using it for anything sensitive or replace it.