I run latest Android version on my 6 years old Pixel 1.
The only reason it isn't provided by Google is that Google doesn't want to.
Sure, Google could release newer Android versions (assuming they'll run under whatever last kernel version Qualcomm provided support for, which isn't always the case), or at least release patches for flaws in Android itself, as long as they'd want to, but after the chipset support runs out, they can't update some drivers and firmware. I think it's not unreasonable to just declare those devices as insecure and move on.
Google has managed to get support up to five years, but only on newer Pixel devices. I'm sure that wasn't an easy negotiation.
Apple, in contrast, builds all the hardware and software in iPhones and iPads, so they can decide to support devices for as long as they wish.
1. The lockscreen bypass security flaw of last week is major compared to any flaw Qualcomm currently have.
2. Apple still updates devices hit with checkm8, so maybe security doesn't dictate everything for them. Not sure why it needs to for Google.
3. What does security has to do with getting Material You to my device? (to give just one example). Maybe the idea is that if a device is insecure, then it must get to the trash bin...? I hope not.
p.s. status on this? thanks https://github.com/phhusson/treble_experimentations/issues/1...
This is basically what I was getting at.