I was upgrading my Pixel 4a recently, and one of my top concerns was security updates. I wanted a phone that would continue receiving timely Android security fixes for at least 3 years, ideally 5+ years.

I liked the idea of Fairphone, but I was skittish about their ability to fund a team to keep up with the latest Android updates for the next several years.

Does anyone know how small players like this keep up with Android updates? I don't know much about how difficult it is to continue pushing Android updates out, but I assume it's at least somewhat difficult, as many of the major phone vendors do it so slowly and eventually stop after 2-3 years.

I realize those vendors have perverse incentives to stop updates to encourage customers to upgrade phones, but I assume some of it is legitimate difficulty of continuing to provide the updates.