Did you miss the part where using an unpatched, always internet connected device is a huge liability? That's the point, he can't not get a new phone because they're cutting off security patches for the one he is using.
Edit: And least we forget...
https://www.softstech.net/list-of-best-custom-roms-for-googl...
I have bought Nokia for the last few years because they were cheap, reliable, had zero crapware, and got updates quickly. The Android One program (no vendor crapware) seems to be winding down, and I value security more highly now, so next phone will be an iPhone. Currently I use an iPad for anything where security matters to me (I haven’t trusted Windows for a decade, and Linux relies on too few eyeballs).