There's also the endless juggles of "is this phone supported, do I need to root it, is the root current, no wait this version is just different enough from that version that I need a custom version of the ROM from a third party, oh the SOC means that the kernel can't be patched for security problems" and so on.

It's a non-trivial effort.