>The kernel used by OEMs is now mandated to be an eLTS version, which is 4.4 now, and the kernel will get backports for another 3 years I think.
That's only true if someone is willing to actually apply the changes over the hacked up kernel the manufacturer shipped. Even well organized projects like LineageOS don't manage to do that:
https://cve.lineageos.org/kernels
Not upstreaming changes is the issue. That's what makes you stuck on an insecure kernel, not the particular kernel version. Having an LTS kernel will help but it doesn't solve anything.
>However, with 4.4 and treble, every device should get updates for another 3 years. And 3 years is better than 0.
Maybe most devices will get an update of the Google shipped stuff for 3 years. Most will not get things like Spectre mitigations in their kernels. And because Treble will be an argument for why this issue is fixed the long term outcome keeps getting worse and this will never get fixed.
>About your phone purchase, there is no other manufacturer that has done a better job than Google so far. So if you care about these sorts of things, just buy whatever Google sells.
For what I want, a proper upstream kernel that has a chance of being supported going forward, Google phones are no better as far as I've seen. They're just subcontracted phones to one of the manufacturers anyway.