At least now now with Google's own chips (Pixel 6+) the guarantee is 5 years of security updates but still only 3 of Android version updates.
At the very least, marketing and packaging for units sold as new near the end of the security lifecycle should have a disclosure like: “We will try to keep this phone secure until [EOL DATE]. Beyond that date, use of this phone may leave you vulnerable to cyberattacks.” Honestly, that would be a great disclaimer to make a legal requirement for all phones, or even all connected devices for which the concept even makes sense.
(Disclosure: I used to work for Google over 8 years ago. But I never had any involvement with Android in any way, other than trying some versions of Android before they were released outside of Google and maybe giving some feedback internally. I’m certainly not speaking for anyone but myself here.)
Which means that after an initial period of half a year of "production is still slow, you have to wait" and another half year of "we maybe start selling this to Europe now", for the device I've bought today, updates will last a mere 2 years.