For example, my Nexus 5 is vulnerable to Broadpwn (CVE-2017-9417), but since Google stop supporting it I'll never get the updated Broadcom firmware. LineageOS can't patch this, so I either need to live with the fact my device is vulnerable to WiFi takeover or switch to a supported phone.
I'm seriously considering picking up an iPhone because of this.
In reality, open hardware is also what's needed, so we can patch firmware ourselves when vendors cant or wont. That too is a massive uphill battle.
With Microsoft, I give them a bye primarily because aside their Surface line, they don't control every possible configuration, and have to deal with a wide ecosystem of hardware.
Also, realize that if we do get repairability laws, the incentive to target and optimize system updates to brand-new hardware will only grow.
And you'd rather not get security updates?
As for the external storage, I can use any flash drive with an OTG micro-USB port, which are common and cheap nowadays (or a regular drive with an OTG cable). But I rarely need the extra space.