CyanogenMod doesn't have all of the source code or the keys to sign low-level firmware, so it's not possible for them to provide full security updates after ven

CyanogenMod doesn't have all of the source code or the keys to sign low-level firmware, so it's not possible for them to provide full security updates after vendors drop support. They only provide security updates for the Android Open Source Project components. CopperheadOS is security-oriented so it's not going to keep devices alive when it becomes impossible to provide proper security updates.