[muppetman]

That's NOT solved by rooting - I wish people would stop saying this.

There's two parts to Android patching - the kernel/Android OS itself - yes, this gets patched with a rooted/custom ROM.

Part two is the hardware drivers themselves, the modem driver etc etc. None of that is patched with a custom ROM. You still have to use the same binary blob/drivers that came with the latest official phone firmware.

When security updates stop for you phone, all the updates for the underlying hardware drivers stop too. So yea, you can slap some bandaids on it, but you're not really up to date even though you might be on a later/more recent version of Android.