The last carrier phone I bought was a Samsung Galaxy 4 from T-Mobile. I got a total of 0 os updates out of it because T-Mobile never released a new version of the OS (even though Samsung did). They just abandoned the phone.
At this point the most important quality of a phone to me is active security updates, so I'll never buy one where a carrier can get in the way of protecting myself from zero day exploits.