Can’t I just not update the microcode beyond what the manufacturer provides, and instead keep updating the kernel and userland and in essence keep updating my android version?
You can’t update the kernel because your phone isn’t running mainline Linux. The device manufacturers (which in this case mostly means chip manufactures) don’t upstream their code. All the device specific kernel drivers are only in special device specific branches. You can get the code for the drivers (because GPL) and do the work to mailine it yourself. In fact that’s what Postmarket OS does to get “proper Linux” running on phones.