They don't have to - just give an option to unlock the device when it's EOL.

It's not a security problem, since they don't support it anylonger anyways!

They could even make it so, that iOS itself refuses to boot if the device is unlocked. That way you can't accidentally have an iOS running that's compromised in some way.

But you can still boot Linux or Android or whatever you want to do to it.