Will an custom rom on an android phone keep getting security update to keep it up to date?

Generally when you install a custom ROM, you will not get any updates from the manufacturer of the phone. You will need to check with whatever person/team made the ROM for updates.

by definition a ROM cannot ever be changed or updated.  that can be both a good thing or a bad thing.  it is good if you never want change.  it is bad if the ROM becomes obsolete 

If you allow for that, yes.