AT&T branded phones, even if unlocked after-the-fact, still only get their updates while on the AT&T network.
No way around that. No amount of "CSC" changing with SamFW or whatever will change that. T-Mobile can't help either.
If you want updates, any updates including security updates, you...