Google already guarantees Pixel security updates for 5 years, so I'd say that's at least the baseline. When Google removed Play Services support for the 4.x series they were 9 years old at that point.

Google still updates the built-in for Android 7. They don't really abandon device support for old OS versions like iOS tends to.

The current situation is that the CA bundle doesn't receive any updates from Google. If your manufacturer repackages their CA bundle and still updates your device, you'll receive a new CA bundle, but I don't believe this is guaranteed.

Furthermore, if you're still running Android 14 after six years, your issue is with the manufacturer of your device. The latest version of the CA bundle will still work of course, but you should really be at least four or five Android versions higher at that point.