Pretty much that is where most of these SBCs fall off my list. Without an active OS development its only 1/2 of the puzzle.
And this is an unfortunate state of the general purpose ARM64 computing. This board, with 16 GB of RAM and M.2 slot, would make the perfect Linux desktop machine. However, you only receive one or two major distribution updates from the hardware vendor, and then you're stuck with it.
I like your optimism. Some boards literally get no updates.
Massive shout out to Raspberry Pi team - Raspberry Pi 1 launched 12 years ago with Debian 7, and currently can run Debian 12.
A lot of these vendors are overseas, do not share my values around open source, and may well look at my computing activity as a potential data mine to be sold.
Maybe I have trust issues. But if I can't install some community OS out of the box without relying on vendor binary blobs, I don't buy the SBC.
I can get arch/slack to work on weird hardware, what I can't do is get the promised hardware performance without specific (usually semi-closed) hardware drivers.
If you're relying on , say, rockchip features -- then you're boned without their support -- this is already a big enough heartach without the malware/data-mine angle (which is likely just as valid.)