Obviously YMMV, but last year there was exactly one OEM merging kernel LTS (Sony). While many (dare I say most?) Custom ROMs do.

I've read a few times that Sony is doing good work in terms of their kernels, but details eluded me, and as the result I never owned a Sony Android phone. Are they really good in that regard? Do they upstream? How long do they publish security patches for?

Yeah so uh, Sony is super weird. There is the production side of Sony, and the developer side of Sony. They barely coexist, they are two completely different minds. Think I'm exaggerating? They have two bootloaders, one for developers, one for production. (The led changes color). Once you have unlocked your bootloader, you have to download and use a different flash tool to flash Sony's ROM. They are not available on the same page. That being said: - the "production" side is a meh OEM. Usually only one major upgrade, annoying lock-ins - the developer side is amazing. They make contribution to mainline Linux, they provide AOSP build trees, they upgrade major Linux kernel versions, their AOSP build tree is much more open source than Google's, they provide very clean fixes for stupid Qualcomm issues that is not fixed even on Pixels, they provide more android major upgrades

So yeah, weird. I believe their AOSP side is funded by some governments who want the most maintainable and auditable Android on their devices

I wonder how much of Sony Mobile is left in Sweden since the Sony Ericsson days. Maybe that's why they differ so much, they come from different company cultures?

They upstream their changes and have a user-unlockable bootloader, which puts them ahead of approximately all of their competitors. Unfortunately they don't really seem interested in selling their phones in most English-speaking markets.

By upstreaming you mean Android project, not Linux right? E.g. not to mainline?

You can have a look at https://github.com/sonyxperiadev/kernel

Downloading a rom from an internet forum to stay up to date with security patches seems like potentially flawed logic.

Where else would you get the update from?

Yes, now you're grasping what everyone is complaining about.