I am not asking about the discontinuation of manufacturing or selling of the hardware; I am talking about only the software.
There are famous old Android devices that the manufactures have abandoned a long time ago, but users are providing custom ROM's. As far as I know, even though those come with latest Android security patches, the underlying low-level parts of the software cannot be updated because only the device manufacturers can make them. And I have heard that manufactures like Qualcomm provide such security updates only for a short time.
So, my question is, what about RP? Say, if I buy a cheap used RP 1 or 2, is it still safe? That is, can I get low-level security patches? And if they are, how long can I expect them to get software updates (both low-level software and the operating system)?