The downside is you get only a year or two of security updates.

You still save something like 400 dollars this way. Not sure what is the actual trade off in your world?

And cut its expected lifespan, already only 2-4 years, by 2 years.

No more software updates isn't such a big deal on dumbphones with limited capabilities, but, on a smartphone, I really do want to be getting those security patches.