In all my life, I have not once seen an android phone actually exploited. I have read about a lot of them online. But I haven't seen an exploited phone in person. Other than exploits that I have used to gain root access on devices, which all require physical access. Around 18 percent of the current android market share is made up of devices running Android 9 and earlier. Android has 3 billion active devices according to the most recent Google I/O. That's 600 million devices. I imagine I will be fine for the next 4 to 5 years regardless of the security update situation.
I will support phone manufacturers that have proper hardware, like a headphone jack and sd card slot over manufacturers that promise security updates every single time. I will continue to boycott phones that don't have a headphone jack. I will not make my current technology deprecated by design in order to have a supposedly flagship phone/device. We should support decent companies like Sony that don't remove useful features in order to create new revenue streams. I have really nice headphones, any phone manufacturer that removed the headphone jack is encouraging me to generate e-waste in order to use their product.
Right now is a terrible time to judge a phone company, the chip shortage hasn't gone anywhere, international markets are still heavily limited. Sony doesn't seem to be looking into becoming a replacement for LG, it seems to be happy existing in its current niche. The advances in camera technology engineered into Sony phones show it does not plan on going anywhere. I will be very disappointed if Sony leaves the phone business.
There are interesting phone manufacturers that I would like to buy a phone from, but they have essentially zero presence in the US.