What about baseband firmware updates? Those come from the vendor of the baseband chip, and they’re extremely security-sensitive as the baseband chip processes network traffic and has a long history of critical remotely-exploitable vulnerabilities that can take over the entire phone, rendering all other security measures moot. Qualcomm, the usual vendor of these chips, doesn’t issue security updates for anywhere near 7 years.