[tarakat]

A related question: How secure is an Android phone that does receive security updates from its vendor? I vaguely recall hearing that it can take months before a security patch makes it from mainline Android to consumer devices.

[warner25]

Yes, this and several other comments have made me realize it's easy but probably wrong to think in black-and-white that: "getting updates => secure; no more updates => insecure." I guess there are no obvious relationships between "up-to-date" Android (for the reason you gave), "old" Android, up-to-date LineageOS, and the acceptable level of security for a common user.