It's worth noting, however, that all of their newer flagships (based on a CPU design they have more control over) have guaranteed security updates for 5 years after release.
FWIW I despise Google and do my absolute best to avoid compensating them, but I do think things like their guaranteed security updates are a step in the right direction, and hopefully we can only get further improvements from here.