This point needs to be stated again. Because the Librem 5 is basically going to be using the mainline Linux kernel, this means that you’ll be getting kernel security updates for as long as it’s a supported device.
That’s decades - plural. You’re not relying on the single maintainer for your particular Cyanogenmod fork, the Linux kernel team will do it for you.
From what I know about Android kernels, they’re all forks of an (several?) older version(s). Sure, you can patch it, but you’ll be applying patches to older and older kernels and it’ll get harder to do as the age difference gets greater.
The same goes for all the libraries and underlying software. Since you won’t be using some weird kernel, you’d be able to either just build the newest versions yourself, or since PureOS is very closely related to Debian, it might well be possible to just point at their arm64 repository and install updated packages directly from there.