If you don't want buy anything, than using old smartphone would be acceptable with disabled all connections (airplane mode) and removed sim cards.
Old smart phones can be infected with malware even before you turn it to an airgapped device, i will say OP should rather stick to the hardware if they are serious about holding their coins securely.
as long as you always update it so that you are not prone to hackers.
Updating the wallet doesnt stops you from attacks or hacks it is just as same as the old wallet just that bugs might have been fixed but external attack are still very much same.
Electrum wallet is not for newbies. This is for those who have a complete understanding of all wallets. While using the electeum wallet, some other security systems like 2FA have to be logged in. Apart from this though it is made for Windows, Mac. However, these devices have more support for Android. After all we know that special security can cause special damage. So I think it will be better to use hardware wallet instead of using electrum wallet.
This is totally wrong, you dont need to set up a 2FA if you dont want it. You can simply create a new standard wallet like the other wallets do except that electrum seeds are custom seeds. You can add pass phrases like other wallets too and also use multi sig if you prefer it. The 2FA just an extra option if you want. It is not compulsory to use it if you dont want it.
Also Electrum is available for all softwares except IOS (iPhone smart phones). That means on mobile device it is available for Androids only but available for all softwares on laptop or computer. There is nothing different with electrum and other wallets.
Although i used electrum on a laptop where it is connected on internet but never had any lost or hacking issue since i entered this space. It's matter of good practice on how to use the device and use AV as precautions to avoid undetected malware on the device.
Yes I agree with you that the way you treat your wallet is as important as the choice of wallet it self in securing its funds. But no matter the level security applied once a wallet is an hot wallet. There is the risk of it getting compromised. You cant be sure or trust it because you havent experience it before. Also it is not all Malwares that an AV can dictate so relying on them too is risky to me