You can also ensure that not many things change over time. My parents have been using Linux for over 15 years and they love it. Mate looks basically the same, as do most of the applications they use (file manager, image viewer, Firefox, Thunderbird, etc.). There's no strange software required for their Brother printer/scanner and nothing suddenly appears with each update.
This how it works or most people in the world. They get a phone and they change it only when they are forced to (hardware failure, some app they absolutely need stops working etc.). The group of people changing phones because they are no longer supported with security fixes is very small.
This is beyond stupid how fucked up the phone market is. I'm still using my 2008 laptop with newest LTS (x)Ubuntu, but my 2018 Android phone lost official support in 2020... Thanks to that, now I have iPhone (longer support) and Fairphone 5 (I like how they try to upstream everything for this phone and promise really long support).
About your question:
Should be fine. As long as browser is up-to-date, she doesn't connect to unknown WiFi networks/Bluetooth devices and she is not targeted. The easiest security fix is to not have anything worth anything on the phone :D
I'm not claiming that there is no use for Jack. I just think that this is a niche and doesn't require a separate connector in every smartphone. Having a universal connector that can be used for various niche scenarios is IMO enough. We should push for improvements in that regard (e.g. make it easy to charge the phone and use the dongle at the same time).
I wish I had the same problem as you do with your car. Mine is old enough that it doesn't have Bluetooth (I'm not the first owner and Bluetooth was an "extra" in this model) but new enough that there is no cassette player (and no built-in aux input) :)
I personally know absolutely no one with a dongle. I know many people who still use phones with jack that are not using it (or have earbuds). I was using wireless headphones before anyone heard of "earbuds" - they are much more convenient in situations where I'm using headphones. Of course, it's anecdotal but it seems that there are much more people like me/my friends than people missing Jack...
It was always like that. If your threat model is three letter agency/Mossad/etc than you have very limited options. Relevant XKCD: https://xkcd.com/538/
In Poland you can do a lot of things digitally by authenticating on governments sites with your Bank (Imagine "Continue with your bank" instead of "Continue with Google" or "Continue with Facebook"). It's nice because bank already verified my identity when I was creating a bank account. I did not have to scan&send anything, go verify in some office etc. and I was able to do multiple things: change how my company is taxed, register for COVID vaccination, government census.
Problem is that "free" is our only option. I would love to pay for search engine that has more configuration options and no ads, I would love to pay for a modern browser (engine) without any tracking and no ads. Reality is that I cannot do that.
And yet, they are probably responsible for 50% of users. My parents, my sister and some of my friends are using Firefox not because they did research but because I recommended/installed it and told them that if they use something else, they are on their own in case of any problems.
I did a few hundred cs overwatch (it's a system where people with 150+ won matches can review suspicious behaviours reported by system/other users - https://blog.counter-strike.net/index.php/overwatch/) cases and 95% of them were people using Spinbots. You can write a program/script that parses demos and detects those in few hours (assuming you don't know how to parse a demo file). Why is this even a thing? I want to help them with fighting less than obvious cheaters but if almost everything I get can be automated by any 1st-year cs college student then what is the point?