That is such a let-down! If Nokia is serious about sustainability, it needs to make it 5y+.
I get it, it is not easy. But with the proliferation of malware and exploits, after 3y (since release, not purchase) this phone is nothing but a liability.
In other words, updates are much less important on android than they are on the iPhone.
How do I determine which, if any, of these is fixed via the Play store update mechanism?
I'm on a Pixel 1 with Android 10. Last security update it got was from October 2019 which is about three years after the phone was introduced.
Is this supposed to be different on newer Android versions?
It started with the browser component many years ago, and has grown its coverage with each version. The limitations are mainly in the kernel, but they now even do graphics drivers this way (though that requires vendor cooperation, unlike everything else), but you wouldn't have that with Android 10.
This capability has steadily grown to cover more of the OS over time, particularly recently, so unfortunately, Yes, Android 10 does have much less of this ability then later versions.
It is called "Android security patch level", that is not a full firmware update. It may still be something else than you have in mind, though. (How) can I check the patch level of the security updates you are relating to?
I don’t know what comes through Play Store, only thing it tells me is that specific app was updated.
All I know is that my cell phone vendors tells I am not getting more security updates.
Consumers should not understand CVEs to feel safe.