To facilitate planned obsolescence, manufacturers stop providing OS updates after a relatively short time. And then they cease providing security patches after a... still relatively short time.
If you unlock the device and install a custom ROM, which may or may not function adequately for you to begin with, then you're probably also compromising secure boot, which is a problem for the security model of how many people use phones -- and many apps simply refuse to work with this setup (whereas the obsolete OS with no security patches is considered fine, apparently).