That implies 5 years of support. Samsung is only offering bug fixes and security updates for up to 4 years from release though, not major releases. The iPhone 5s just got a point release this January, and that phone came out in 2013 so that's over 7 years and counting. The iPhone 5 also got 7 years of fixes (well, 6 years and 10 months).
Each new version of iOS/Android is more resource-hungry than the last, and expects better hardware to run it. Many people with Apple device complain, "This new version makes my old iPhone/iPad so slow it's practically useless." So in most cases, people want to keep using their old devices (presumably at the performance speed they were running previously), but they are compelled to stop using them when they stop receiving updates, because the unpatched bugs/exploits could put their data at risk.
While there are definitely many people who would like the latest-greatest OS on their device, I think a large number of people would be happy with their device's current OS, patched to ensure that it's not vulnerable to an active 0-day exploit.
Best of all worlds.
most people don't care about patch level either. if they care about OS versions at all, they just want the option to decline so their old phone doesn't get "slower". outside of my tech friends, no one I know takes security updates into account when purchasing a new phone and/or retiring an old one.
in any case, OS security updates are only part of the story. eventually important apps you use will require a higher OS version for updates. then you're using a secure OS, but possibly stuck using an old version of an app with its own known vulnerabilities.
On iOS, the bundled apps are locked to the iOS release. One of these is Safari - the only browser allowed on iOS. So to have a current browser it is critical to update the underlying OS too.
On Android, this is not the same. The apps are updated even if the OS is not; so you will have Chrome (or Firefox) in the current version, even if your vendor doesn't update the OS.
https://source.android.com/devices/architecture/modular-syst...
Fragmentation on Android makes it worthwhile to only test on the flagship phones with a few different version. Everywhere else is pretty much too small to be worth the effort.
I count 43 of these fixes are for issues with the underlying AOSP platform, kernel and drivers. One of them is a Play Store codec update. Admittedly not all of those fixes are relevant to every device because some of them (about a dozen) are specific driver updates, but over 40 fixes in one randomly chosen monthly update isn’t trivial. This is what you lose when your device goes out of support.