Except, of course, getting your hands on a phone that has Oreo.
For instance, the Galaxy S8 is the hottest new thing on the market right now, and it launched with Nougat. It will probably be six months to a year before Samsung pushes an Oreo update to it, if at all.
Samsung actually has a decent track record of updating their software -- my family's Galaxy S5s on T-Mobile (purchased 2014) are actually still receiving security updates, despite being on Marshmallow API level.
It doesn't help with things like firmware vulnerabilities (without some extensive reverse engineering). I can get LineageOS on my Nexus 5 just fine, but it doesn't have broadpwn fixed.
(note that I wasn't able to actually replicate broadpwn on Nexus 5, if anyone was, some info would be appreciated)
For instance, the Galaxy S8 is the hottest new thing on the market right now, and it launched with Nougat. It will probably be six months to a year before Samsung pushes an Oreo update to it, if at all.