Do they require the hardware drivers to be upstreamed to the Linux kernel?
If not, then there's no way to patch security issues.
Also, what about the binary blobs, such as the cell and wifi chipset operating systems?
I don't know but the hardware drivers are not directly exposed to the web. The biggest security issue is the web facing attack surface and Google is in complete control of that.
Or they can continue to get automatic browser updates after the platform updates stop with Lacros.
afaik you can't install another OS on any chromebook, some are locked
Wrong, Chromebooks aren't locked by default. But the owner/institution can opt-in to lock them.