Comment by grapheneos

Android Open Source Project userspace code runs on any devices with Treble. That means it runs on any certified Android devices with the ability to install another OS. Updates and security features for the Linux kernel, drivers, firmware and hardware are still needed.

Fairphone 5 and earlier have end-of-life Linux kernel branches without security support. Those lag multiple years behind on providing full Android security updates. The 1-2 month delays for partial security backports is compared to the Android security bulletins and is actually a much longer delay compared to when the patches are made available to ship by OEMs.