I would contend that even if 1% of users were to notice or care that their phone didn't get the latest security updates anymore, the vast majority of those users wouldn't do anything at all to remedy that issue.
Look, most Android devices are held by people who would be hard-pressed to tell you which model of phone they have, and almost certainly can't find the place to see what version of Android it is running.
Most people will use their tech until it breaks and then get something new and use it until it breaks, which is why automatic updates are pushed so aggressively now.
My personal opinion of roms is that because they do not offer freedom to the masses, it is elitist to focus on them. And insofar as choice in the ecosystem is, roms are actively harmful: They've wasted decades of volunteer developer-hours protecting Android's control of the ecosystem, when those developer-hours could've been invested in real mobile Linux or another option not encumbered by Google's proprietary stench.
Look, most Android devices are held by people who would be hard-pressed to tell you which model of phone they have, and almost certainly can't find the place to see what version of Android it is running.
Most people will use their tech until it breaks and then get something new and use it until it breaks, which is why automatic updates are pushed so aggressively now.
My personal opinion of roms is that because they do not offer freedom to the masses, it is elitist to focus on them. And insofar as choice in the ecosystem is, roms are actively harmful: They've wasted decades of volunteer developer-hours protecting Android's control of the ecosystem, when those developer-hours could've been invested in real mobile Linux or another option not encumbered by Google's proprietary stench.