> any normal OEM's support?

What "normal OEM support" (like which company, for example?) has been good at regularly releasing security patches and keeping on top of various vulnerabilities? Especially past the 1-2 years after the release date of the device? Especially if you consider those companies that without any real consent from you install dozens of their own adware and spyware on each update that you can't even remove (like you can't remove system apps in android, only "disable" them, to make the phone nag you all the time to re-enable them).

Not having to rely on the joke of the "OEM support" from the big companies is the very reason to use these open phones.