When an the OS for an Android phone is created, the Linux kernel is forked, and the firmware/drivers for it’s hardware components are laid on top (instead of being upstreamed to the kernel). When the manufacturer decides they no longer care about that phone, they stop updating firmware and that will no longer receive updates. You might use a rom that still updates everything else, but these critical parts won’t get updated anymore.
The newer Pixel generations get 5-7 years of security updates (IIRC). I believe IOS devices get 5 years.
Android and arm has (/had? I might be partly out of date) a lot of out of tree (not included in the upstream Linux kernel) code which makes booting it on Linux a shit show.
This is also why so few devices are supported by the Linux-phone-OSs.