Why not buy a phone with known good LineageOS support if you're afraid Google may update your phone? You can audit and compile the entire OS yourself and disable any CA certificates you may dislike.
Show companies that there's money to be made by buying devices to your liking or you'll be subject to design decisions made for the vast majority of customers. Why should companies care about your specific wishes over everyone else's if you're not putting your money where your mouth is? They exist to make money, they're no government or charity.
Everybody has been screaming at Google about how Google can't keep Android up to date since Android 2.1 launched. The geneewl comsensus is that if you wqnt updates and security, you need to buy an iPhone. They're finally fixing this problem but every step along the way the percentage of a percentage complains that they're the victim of Google's conspiracy.