Hasn't that always been the case? The project is community-driven and nobody wants to maintain a device they don't use anymore. Often there are other maintainers, but sometimes there are none.
>They preach security is their focus, but doesn't look like that.
I wasn't aware of any big security issues. Can you give an example? In terms of security patches LOS is usually more up to date then the OEM roms.
>vendor roms are quite good already, no need to install unstable roms like it's 2015.
They also come with all kinds of stuff many people don't want on their phones. If want current security patches (especially on older devices) and no Google Apps, preinstalled vendor apps, telemetry etc. you still have to install a custom rom. In my experience LOS is very stable too.