How will they support security updates for 6 years when Google isn’t supporting that? Google usually deprecates support after 2-3 years. Also some security fixes require new kernels so there’s that.
For Samsung to do that they’ll essentially will have to fork Android.