> So if you release the feature branch every 3 months after a few years you will have a dozen maintaining branches to backport fixes to, and in which to carefully test that the fix actually works. The problem is linearly worse if you release the feature branch more often.

This has been solved by LTS releases for some time. You have a newest release branch that gets feature updates immediately and an LTS branch which has a full release e.g. once every two or three years, at which point it catches up on features to the then-current newest release branch. The newest release branch doesn't have long-term support and you're expected to take the latest feature update, the LTS branch gets only security updates, the user can choose between the two or three LTS releases currently in the support window or the newest release branch.

This was, I believe, the problem that Microsoft wanted to resolve with their gradual burndown of WSUS - a lot of shops (including one I used to work at) would selectively roll out updates based on whether they thought they were relevant, resulting in an explosion of configurations that Microsoft had absolutely never tested against, and naturally, a lot of breakage.

Or give the user the choice when first powering on the device.

Select: Base version that will only receive security updates. No changes in features. OR All updates

Edit: By "Base version" I mean the first software version for that device.