How do you make sure that the security flaws are patched promptly? Do you open a ticket on GitHub and simply hope it gets picked up by the devs?

No you dont expect free labour and pay them.

They can just sell their normal phone. As long as the user is able to run the installer it doesn’t really matter.