Yep, this is a pretty serious problem; even if you want to purchase a "supported" device, the odds you'll get feature upgrades aren't great. The list of currently supported devices is quite small, and many of those don't receive any maintainer edition - they're just letting the weekly automatic builds happen. So there's not really any hope that the Nexus 5X, for example, will ever get Android 9, let alone Android 10, with LineageOS. It's stuck on LineageOS 15.1.
If you want to go to less trusted ROM sources, like PixelExperience, you can do that... but unlike LineageOS where you're likely to get ignored by maintainers, trying to keep the phone on its latest version means that things are broken half the time. Currently the Nexus 5X is hardly usable with the PE ROM.
It's really a sucky experience currently if you want to buy a smartphone for longevity. Everything is built around the wasteful and expensive 2-year upgrade market, and since that's the most profitable, we're not likely to see improvements soon.
From a security perspective, custom roms are still worth it.
And those are the painful ones, since drivers have kernel access. The security situation on Android is really less than ideal :/
You know, maybe I was lucky or hit some weird Window, but they used to have S7 Lineage OS on there and I still run it on mine.
The problem is it seems to be past its prime. It dropped support for mainstream phones more and more and is currenly limited to either very old handsets or rather exotic manufacturers.
The most recent Samsung S series they support is from 2014, almost six years ago. CM and LOS were also popular on the Nexus 4 and 5, these were completely dropped as well and even the successors do not have a recent Android version at this point.
All of this coupled with long delays of moving to the most recent Android version. Many phone were still on Nougat LOS, when there was already Pie.