Indeed. Google uses their (probably illegal[0]) contract to mandate that Google+ must be preinstalled on your phone, but not that your phone must get security updates for a reasonable period of time.

[0]http://money.cnn.com/2016/04/20/technology/google-android-la...