Anyone needs reminding that you can't trust what Google promises especially when it comes to their products?
Pixel phones get security patches for at least 3 years from when the device first became available, or at least 18 months from when the Google Store last sold the device, whichever is longer.
I'm sure Pixel customers who didn't read up on the software support duration were disappointed that they only got three years of updates, but Google seems to have kept their promises with Android at the very least.IoT crap is a different story, though. Then again, I don't think there's a single IoT vendor that I trust to provide security updates for a normal amount of time.