All Google phones allow installation of alternative OSes (and are pretty much the only phones that allow resigning the boot loader so they're still secure - which is why they're chosen by projects like GrapheneOS). Why do you think they need to be forced into anything? You can buy a Pixel right now and run an alternative OS.

I think this is also the answer to "the app store question". It feels unfair to force Apple to change a core value proposition by forcing them to allow side loading, but in the spirit of "It's my device" it should be possible to install an OS that makes a different tradeoff e.g. Android

* If you don't use a super popular model, you would have very few choices for custom ROMs * Often custom ROMs are still at the mercy of original manufacturer for certain hardware support -- e.g. they need to release "base AOSP image" or something like that * Custom ROMs often had random things not working, e.g. NFC not functional or cell/WiFi signal weaker than stock ROM * Some come with certain crappy preinstalled apps. Sure you can remove them, but still annoying * Battling SafetyNet was a cat-and-mouse game which I gave up * Browsing xda-developers forum and following the latest reply of a 10-page, 200-post thread like back in the early 2000s was the only way to get updates of a certain ROM. OTA updates were mostly out of the question * ... and many more added to this

I don't know how much has changed, hopefully a lot. I don't doubt if you have a phone of a popular model, you can find a custom ROM that does not make compromises and is much cleaner and better than the stock ROM. But these days I simply don't have any time for tasking the risk and messing with these things and worry WiFi might not work in some cases.

What's stopping you from keeping your Android 6 years making it an event better value? Most people I know don't throw away their Androids after 3 years but keep them as long as iPhones. Basically until it breaks/dies. So far I don't know anyone who got hacked and suffered damages for using an Android that stopped getting updates.

Obsession with zero day patches and security hypochondria is mostly a HN/tech-workers thing as if they're under attack by state actors using Pegasus. The average joe doesn't care not is he very likely to be impacted, unless using Android Jellybean or something, since most malware in the wild out to get them is script kiddie level not state-actor level.

And anyway, someone correct me if I'm wrong, but from my knowledge and experience with Android security, most Android critical vulns that can impact the day to day security of the Average Joe are covered by updating Google Play services and Chrome or whatever browser you use as those are the main attack surfaces for (non state sponsored) malware based on what people do with their phones, and those services keep getting updates from Google long after the manufacturers stopped pushing OS updates.

That’s a “hope for the best” approach to security, for me it’d be irresponsible to recommend it to even friends and family.

But if you want to do it with knowledge of the potential problems — go for it. It’s your phone and your data.

Here's a though exercise: Most people use their device for browsing the web and messaging people, right? So as long as you keep your Play Services, browser and messenger apps up to date, how will malware get to the outdated layers of your OS to PWN you? Especially that modern web browsers and Andorid use sandboxing for apps and web tabs. I'm talking about realistic documented scenarios from the wild that have happened and are likely to repeat again, not state actors or scenarios from research labs where they hack you through the firmware vulns of the baseband modem.

Like I said, I'm not recommending you still use unpatched devices, but the realistic risk from using an Andorid device that stopped getting updates a year or so is relatively minimal in practice, otherwise there would be mass hacks and credential thefts left and right on a daily basis considering how many unpatched Android phones are out there.

[0] https://www.lineageos.org/ [1] https://grapheneos.org/ [2] https://calyxos.org/ [3] https://download.lineageos.org/devices/sailfish/changes

People who’re comfortable (or can be bothered) installing alternative OSes on their phones have an entirely different view on device obsolescence. Statistically they’re also a rounding error in the total mobile-using population.

Understood, but that has no bearing on the point being argued. You have no control over Apple IOS hardware after Apple stops supporting it. The fact that there is that "rounding error" is good for everyone as it is a force against closing that ecosystem which currently exists. It matters.