Google already guarantees Pixel security updates for 5 years, so I'd say that's at least the baseline. When Google removed Play Services support for the 4.x series they were 9 years old at that point.