> Assuming that the device has an up-to-date browser available for it.
Not necessarily. You can target older devices with old browsers if you want, by carefully choosing JS/CSS versions and features, or just by making sure your code degrades gracefully.
The older browsers that would run on these devices have known exploitable security issues. The newer browsers are very heavy because they support navy features and expect that the hardware is newer.
The problems begin accruing before the user even types in your URL.
Not necessarily. You can target older devices with old browsers if you want, by carefully choosing JS/CSS versions and features, or just by making sure your code degrades gracefully.