One of the primary reasons to avoid using a MacBook after it has stopped receiving security patches is that it's at risk of being targeted by malware or other actions by bad actors. In a notable example from 2021, a likely state-sponsored attack targeted visitors to Hong Kong political and media websites using an XNU kernel privilege escalation flaw in macOS Catalina and Mojave. Attackers can also sometimes keep an eye on patched zero-day vulnerabilities in newer macOS versions and then use those vulnerabilities to target older versions that don't get the patches. All this makes it pretty unsafe to keep using a completely unsupported MacBook. Depending on your risk tolerance and risk profile, you can choose to upgrade to a new MacBook immediately after it stops receiving major macOS versions or wait until it stops getting security patches.