I'm also fine with sticking to older models. Never seen the point of having the latest and greatest (aka: pointless) feature anyway. Does certification only apply to new hardware or do manufacturers back-port it?
Amazon's "Kindle" tablets and TV devices famously do not ship Google apps, and sometimes you see restricted devices like the Rabbit R1 that just use the open-source parts of Android. But outside of China I don't think you can easily walk into a store and find a non-Google Android phone.
I don't think phones ever officially lapse out of Play Protect certified status -- the Nexus One, a phone from 2010, is still listed -- but presumably it'd be possible to find a phone old enough that it won't be able to download whatever Play Services OTA update they'll use to push this change.