I believe the situation with this has improved. Before EAS you needed to target one of the more recent SDK versions or you wouldn't be able to build using their services. However, if your app is new (or upgraded) enough to use EAS now then you don't get locked out of building anymore.

But still, upgrading SDK versions to stay on top of security/new features can be a burden with how many breaking changes there are.