Old Chromebooks can run Linux, or ChromeOS Flex

Or they can continue to get automatic browser updates after the platform updates stop with Lacros.

Do they require the hardware drivers to be upstreamed to the Linux kernel?

If not, then there's no way to patch security issues.

Also, what about the binary blobs, such as the cell and wifi chipset operating systems?

I don't know but the hardware drivers are not directly exposed to the web. The biggest security issue is the web facing attack surface and Google is in complete control of that.

afaik you can't install another OS on any chromebook, some are locked

Wrong, Chromebooks aren't locked by default. But the owner/institution can opt-in to lock them.

https://MrChromebox.tech/ would like to have a word with you.