My apologies for the delay. It had taken a while to craft a reply, and then I had to step away for a few days to do some house things.
In the time since I wrote the post below, this article came out from Arstechnica. I link it simply to illustrate the point that things are always changing and even a server that looks secure might have been compromised, somehow. I expect to hear more about this incident in the not too distant future. I'll probably be grabbing the report from Eset to look over as well.
User caution is very important. If you have a sufficient amount of it and you're taking all the other technical precautions Galgot mentioned (including some more, such as no Java, Flash, etc), just being careful and aware is a good idea. Unfortunately, that runs counter to what most Mac users, even enthusiasts of outmoded and unsupported OS X systems, tend to have the wherewithal to do. There's a huge perception out there -- and has been for a very long time, that Macs are totally trouble-free and that they're completely rock solid and that they are totally impervious to attacks of all kinds. That causes a really lax attitude and I'd say more often than not, the lax attitude is often what gets malware installed on Macs. This isn't just a problem on old Macs. (In fact, from a pure "malware" perspective, OSX/PPC is probably a lot less likely to get any "malware" than, say, a system running 10.8 or 10.9, and from a pure quantity perspective, there's less of it than on Windows, even with Windows 7, 8, and 8.1 each making Windows more difficult an environment for malware.
The thing is, even on supported systems from vendors that are really active with patches, you're really not ever "done" with security. You have to run patches, if you're really interested you have to find out what those patches are. Once a system falls out of official support, you need to manually start reviewing possible vulnerabilities and essentially look for things to patch or mitigate on your own.
A way to avoid all that is to simply put the system(s) on a non-routable darknet, which is basically my plan should I ever end up with another late PPC system running Mac OS X. It's a good way to reuse old (probably also insecure) LAN equipment, and you can configure your modern file server with two network interfaces, so you can still do things such as share files, telnet/SSH to your server form your old machines, use them to fetch your e-mail, and if that server is running some form of Linux or UNIX on it, you could use Firefox/Thunderbird etc to access public Internet resources using it.(1)
To talk to the issue of rooting a box(2). A few months (almost a year ago?) somebody mentioned that they felt confident that they knew everything there was to know about Mac OS X 10.4 and 10.5. I didn't say anything about that particular point until shortly thereafter, some new types of reflection attacks were discovered, along with shellshock, and several other vulnerabilities of various types have shown up since then. Many of these vulnerabilities impact old code that has been around a while. (The shellshock vulnerability affecting bash had been around for over twenty years, for example.)
So, if somebody takes the time to essentially review every CVE between when the last security patch for 10.4.11 came out, harden it using typical best practices, and then start re-compiling or somehow disabling every impacted component, it could be a great resource for the community of people using those machines. (At least those who bother to look for that kind of resource.)
So, I can't specifically say today for sure what the risks are going to be down the line in the same way that before September 2014 I couldn't have told you that shellshock was going to be a thing, and with shellshock, it's possible to use DHCP flags to set the root password on a Linux system.
The point there is that even if you've personally audited the entire codebase, vulnerabilities have since been found. Some free operating system projects are involved in an effort to start continuously prune and polish all of the code, which is good and their work should improve everything for everybody.
Some components of Mac OS X (bash, in particular) have been updated by knowledgeable members of the Mac/PPC scene. To my knowledge, that's the only such thing that has been updated. This is because I simply don't have a personal interest in it, but as far as I know, no PPC-focused community (most of the MacPPC-specific sites I've seen so far individuals' blogs) has put together a security resources guide, not only with information about how to harden Mac OS X using what's built in, as well as what to replace and how to either compile new OS components from scratch, or providing installation packages.
(1) This is insanely tangential, but that would be a good way to use a whole lab of G3s or G4s running Mac OS X with a single faster system, simplifying account management, management and security of the Macs themselves, and providing an environment that is actually faster at rendering pages or running more updated versions of heavy software such as GIMP and OpenOffice.ORG.
(2) Actually, setting the root password on Mac OS X has long been considered a bad practice. The fact that Apple keeps root disabled is probably like the one thing that saved a few of the boxes of people who boast about Mac OS X security.
In the time since I wrote the post below, this article came out from Arstechnica. I link it simply to illustrate the point that things are always changing and even a server that looks secure might have been compromised, somehow. I expect to hear more about this incident in the not too distant future. I'll probably be grabbing the report from Eset to look over as well.
User caution is very important. If you have a sufficient amount of it and you're taking all the other technical precautions Galgot mentioned (including some more, such as no Java, Flash, etc), just being careful and aware is a good idea. Unfortunately, that runs counter to what most Mac users, even enthusiasts of outmoded and unsupported OS X systems, tend to have the wherewithal to do. There's a huge perception out there -- and has been for a very long time, that Macs are totally trouble-free and that they're completely rock solid and that they are totally impervious to attacks of all kinds. That causes a really lax attitude and I'd say more often than not, the lax attitude is often what gets malware installed on Macs. This isn't just a problem on old Macs. (In fact, from a pure "malware" perspective, OSX/PPC is probably a lot less likely to get any "malware" than, say, a system running 10.8 or 10.9, and from a pure quantity perspective, there's less of it than on Windows, even with Windows 7, 8, and 8.1 each making Windows more difficult an environment for malware.
The thing is, even on supported systems from vendors that are really active with patches, you're really not ever "done" with security. You have to run patches, if you're really interested you have to find out what those patches are. Once a system falls out of official support, you need to manually start reviewing possible vulnerabilities and essentially look for things to patch or mitigate on your own.
A way to avoid all that is to simply put the system(s) on a non-routable darknet, which is basically my plan should I ever end up with another late PPC system running Mac OS X. It's a good way to reuse old (probably also insecure) LAN equipment, and you can configure your modern file server with two network interfaces, so you can still do things such as share files, telnet/SSH to your server form your old machines, use them to fetch your e-mail, and if that server is running some form of Linux or UNIX on it, you could use Firefox/Thunderbird etc to access public Internet resources using it.(1)
To talk to the issue of rooting a box(2). A few months (almost a year ago?) somebody mentioned that they felt confident that they knew everything there was to know about Mac OS X 10.4 and 10.5. I didn't say anything about that particular point until shortly thereafter, some new types of reflection attacks were discovered, along with shellshock, and several other vulnerabilities of various types have shown up since then. Many of these vulnerabilities impact old code that has been around a while. (The shellshock vulnerability affecting bash had been around for over twenty years, for example.)
So, if somebody takes the time to essentially review every CVE between when the last security patch for 10.4.11 came out, harden it using typical best practices, and then start re-compiling or somehow disabling every impacted component, it could be a great resource for the community of people using those machines. (At least those who bother to look for that kind of resource.)
So, I can't specifically say today for sure what the risks are going to be down the line in the same way that before September 2014 I couldn't have told you that shellshock was going to be a thing, and with shellshock, it's possible to use DHCP flags to set the root password on a Linux system.
The point there is that even if you've personally audited the entire codebase, vulnerabilities have since been found. Some free operating system projects are involved in an effort to start continuously prune and polish all of the code, which is good and their work should improve everything for everybody.
Some components of Mac OS X (bash, in particular) have been updated by knowledgeable members of the Mac/PPC scene. To my knowledge, that's the only such thing that has been updated. This is because I simply don't have a personal interest in it, but as far as I know, no PPC-focused community (most of the MacPPC-specific sites I've seen so far individuals' blogs) has put together a security resources guide, not only with information about how to harden Mac OS X using what's built in, as well as what to replace and how to either compile new OS components from scratch, or providing installation packages.
(1) This is insanely tangential, but that would be a good way to use a whole lab of G3s or G4s running Mac OS X with a single faster system, simplifying account management, management and security of the Macs themselves, and providing an environment that is actually faster at rendering pages or running more updated versions of heavy software such as GIMP and OpenOffice.ORG.
(2) Actually, setting the root password on Mac OS X has long been considered a bad practice. The fact that Apple keeps root disabled is probably like the one thing that saved a few of the boxes of people who boast about Mac OS X security.