

GrapheneOS kills support when Google kills security updates, I believe. Source: my Pixel 4a came out in 2020, and Graphene already strongly recommends against using it and dropped updates entirely a few months ago.
Lineage and Pixel Experience ROMs are better at long-term support. But any custom ROM on older non-officially-supported phones is vulnerable to firmware exploits, since those fixes are typically distributed as binaries by the hardware manufacturer (Qualcomm etc). So I understand why Graphene drops support so quick, since they want all Graphene users to benefit from strong security practices.
I use Jellyfin to host my music, and Finamp on my phone to browse and listen to it. Finamp supports downloads as well, so you can listen to your music offline and away from home. Pair that with a self-hosted VPN to access Jellyfin away from home and you’ve got most of your needs covered!