Yes thanks, somehow my cut paste skills were left wanting in this instance. Fixed 
Now to patches, it is confusing (at least to me!). If you look at “System Settings > About Phone > Android Version > Details” you will see there are 2 fields:
- Android security update: I think is what we would call the “OS / software update level” and comes from upstream LineageOS. It is this that can update even after a manufacturer abandons a device.
- Vendor security patch level (SPL): this is what comes from the vendor / manufacturer, but it does get incorporated into / used by the OS as well (this is the confusing bit). So it is issued by Fairphone but it is incorporated into the Android base (in this case LineageOS). It is moving to an older version of this that will trigger the “rollback protection”. When it gets incorporated into upstream LineageOS and when the iodéOS build is made determines what level is included at the time. It is a “timing dance” to try to wait for it to build the next round of iodéOS, but if there is a slight delay then the monthly build may precede it getting incorporated, thus we are “a month behind”. I have requested that the iodéOS builds would include the included SPL date in the build name, but that isn’t implemented (yet?).
As an example of the above in action, my old Pixel 3a XL shows this “vendor SPL” of May 5, 2022 since that is when Google abandoned the device. But I have a “Android Security Update” of March 1, 2026 since I am running iodéOS 6.13 (created by me ) on the device.