More like Qualcomm doesn't want to spend the money to do it. Google can't update the binary drivers and firmware that Qualcomm gives them. And Google only has so much leverage in order to get Qualcomm to provide updates to older hardware.

Sure, Google could release newer Android versions (assuming they'll run under whatever last kernel version Qualcomm provided support for, which isn't always the case), or at least release patches for flaws in Android itself, as long as they'd want to, but after the chipset support runs out, they can't update some drivers and firmware. I think it's not unreasonable to just declare those devices as insecure and move on.

Google has managed to get support up to five years, but only on newer Pixel devices. I'm sure that wasn't an easy negotiation.

Apple, in contrast, builds all the hardware and software in iPhones and iPads, so they can decide to support devices for as long as they wish.