You should be able to throw LineageOS on there as long as you don't have a locked Verizon bootloader. But there are a lot of caveats to that, in terms of which apps will work when rooted, which won't etc. etc.
Firmware doesn't include kernels, generally speaking.
There's nothing stopping you from grabbing those blobs out of Google's AOSP images and updating them, but there's no way to ensure the abstraction layers work correctly with them unless you test it.
As always, it depends.
There is a lot of real usage which is not "banking/payments/secure messaging". Besides, stopping security updates does not mean the phone suddenly becomes open to the whole world. Many vulnerabilities might be exploitable only when running code natively on the device, or only when within radio range, or only when plugged directly to the USB port.
In fact, I don't do any of those on my phone. Unless maybe you count email as secure messaging in some way.
I would say yes, considering email is often used as a primary means to reset account passwords. Most services support MFA (which could be somewhat of a mitigating security control), but a LOT of services still don't.
(though banks are also clueless in other respects, outlawing devices with lineageos but allowing devices with out of date vendor OS)
If there's a vulnerability like stagefright in the base system that could make many up-to-date apps vulnerable, you'll hear about it on the news.
That's a bit hyperbolic. Your point stands, otherwise.
Personally I don't see how anyone could justify having an out-of-date phone. Assuming you have it configured to read your email, it becomes a gateway to every account you own, which can have its password reset over email. MFA might help as long as that MFA isn't an app on your phone. But most websites don't support hardware security keys. If you care enough to have a dedicated TOTP device, then why would you want a phone with no security updates?
This use of "forcing" does not require bricking the phone. Creating a situation where the only reasonable choice is to upgrade the hardware qualifies as "forcing" in my opinion. The phone is no longer capable of performing the job for which it was designed in a safe way.
And you're probably thinking "oh but this is an old device, just get a newer one for work." True, but consider that Pixel 6/6 Pro users got screwed over when the December update was yanked [0] and the January update got delayed for them [1] - while it was good for most users not to take the buggy update, anyone whose device had those security requirements ended up getting work-related functionality disabled.
Of course, the companies that set these policies are generally ones who will not make exceptions, so even though you had the latest and greatest from Google, you couldn't use it for work for several weeks until they finally pushed out the January security update.
"People who have MDM-enforced security requirements" might not be a large part of the smartphone market these days, but every little bit counts when it comes to reducing the volume of e-waste that usually ends up being dumped in third-world countries.
[0] https://www.reddit.com/r/GooglePixel/comments/rxiv5r/enterpr...
[1] https://support.google.com/pixelphone/thread/143968432/googl...
My bank disabled the app on my phone some 4 months later, when some major vulnerability was still unpatched on my phone. They told me to get a new phone, so I picked up an 2016 iPhone SE and went on my way.