You don't need a new Android phone every two years and you haven't needed to for a while now. The Android situation certainly isn't as good as the Apple situation, but it's not as bad as ten years ago.
For most people, the only problem using a five year old phone today is the degraded battery. Almost all software is backwards compatible with the old operating systems and nobody simply outside IT cares about kernel updates. Journalists, human rights activists and American refugees like Snowden should fear kernel exploits, your average Joe is pretty unlikely to actually get infected. The massive segregation of Android devices is actually a good thing in this scenario, because you need to prepare your exploits for whole ranges of devices and several versions software versions, making "the Android botnet that ends all Android botnets" incredibly hard to build.
The Android privacy nightmare is all Google being built around spying; the security nightmare is mostly due to brands like Samsung not releasing timely updates, not necessarily because Broadcom and Qualcom don't build patches.
With medium to high end Samsung devices now reaching four years of Android security updates, the entire field is slowly becoming much better. The cheaper, low-end devices lag behind, but it figures that people who cannot afford a $300 phone can't pay for software support and the profit margins become razor thin the cheaper the phone gets. Five years of software updates for a $90 phone just isn't realistic.
This whole situation is why I lament Windows Phone's failure. Microsoft had the right idea, which carriers hated, that the operating system should be independent of the rest of the device. Carriers wanted to force their ugly branding everywhere and fought hard against MS, who themselves bumbled and failed spectacularly by breaking backwards compatibility with every major Windows Phone release, and the entire project was doomed to fail.
Android could have been similar to Linux; a Google-supported core repository with vendor packages for drivers, updatable in the same way Debian is. Nobody outside the hacker community seems interested in this approach, but it could have been.