Not Samsung itself
I have three Galaxy Note 5s. (For reasons.) Two of them run custom roms. The third is still stock. The reason? It's an (ex) AT&T device which will never get a custom rom because AT&T wouldn't allow the bootloader to be unlocked and no one managed to crack it. Strictly speaking I can't say how easy it is because all my Android devices have been Samsung so I don't really have a baseline but I've never had from the Samsung side. Indeed the software that does the flashing (Odin) was leaked from Samsung (apparently several times as there are several versions floating around) and, as far as I know, Samsung has never done anything about it. Just stay away from AT&T.