I thought that it still _may_ receive security updates. But now it's on Google's mercy. Or is the fix impossible without whole OS update for some reasons.

Either way it is ridiculous indeed. I have a 5X. It certainly pokes me to install LinageOS faster. A side question: does anyone use Plasma Mobile on their 5X? - https://www.plasma-mobile.org/neon-arch-reference-rootfs/