GrapheneOS and PostmarketOS are independently developed forks, not a “hacked android rom” (I guess you’re saying that to demonize the projects and imply ineptitude?), and have hardware support lists along with expected security support lifetimes if you’re willing to look.

Also, as I mentioned to the other commenter, every manufacturer should list the EOL support dates on their website. Just read that, and then pick accordingly. Or, and crazy thought here - look around for community reviews and recommendations! Don’t just go off Apple’s marketing! Wild concept!

(Also pinephone and Fairphone are two examples of Linux phones, but they aren’t super fleshed out yet so I wouldn’t recommend them either. Just find a device with a good EOL date and an unlocked bootloader.)