The security model of GrapheneOS and CalyxOS are similar on this specific issue. They drop support after OEM support has ended because the proprietary drivers that are borrowed from the official ROM stop being updated. It introduces an unpatchable security hole unless someone can reverse engineer all the proprietary drivers and keep updating them with security fixes, and even then, hardware security flaws may eventually surface.

LineageOS and iodéOS are good for keeping older devices working as long as you are okay with a looser threat model (not having those hardware level security updates, and not having the extra features provided by Graphene or Calyx)

postmarketos is a Linux distro aimed at reverse engineering those drivers to allow supported phones to live even longer. However, the team doesnt recommend ANY devices for daily driving. The OnePlus 6T and Pixel 3 are recommended for people who want a tolerable experience but they are not perfect. The Pixel 6 series was recently supported, but Im not even sure if they have graphics drivers working yet. (not to mention, pmos has no security features outside of LUKS encryption. No measured boot, no sandboxing, no fine grain permission control etc)