Android manufacturers pick a LTS kernel when developing their phone. By the time it is on the market, that kernel version only has 3-4 years left of security updates. Custom roms never upgrade the kernel so you are still vulnerable to bugs that were never backported to your kernel
Depends on the manufacturer, there are plenty of phones with community updated kernels. Some manufacturers choose to implement hardware support by poorly forking the Linux kernel in ways that make porting those changes to recent kernels hard.
PostmarketOS is the mainline Linux kernel and doesn't have all the features that are needed for a proper Android phone. There are a lot of Android userspace drivers that may break with another kernel.
Custom kernels are not upgraded kernels. They usually just back port a few fixes. No custom kernel running Android has a full kernel upgrade because it breaks the KMI and kernel drivers aren't usually updated.
