We are, of course, very dependent on LineageOS.
LineageOS dropped security updates of version 15.1 (android 8.1) in september 2021. Except Mi9, all our supported devices run android 11. We can reasonably think, if LineageOS keeps supporting android versions of the 4 previous years, that we will be able to provide security updates for that period of time, after the support of a phone has been dropped (by staying on the last available android version for that device, unless we find enough manpower to upgrade ourselves the device trees to the next android versions).
However: of course the vendor blobs won’t be updated, and maybe the kernel, unless we find convenient ways to update it (looking at DivestOS for that purpose).