Samsung is however among the best in that regard. The last security update received on my phone was in February of last year, so almost 4 years after the release of the device. However I forgot how many os updates the device got, but there's at least one received during the first year.
But the company improved its updates policy since. I purchased a galaxy tablet 3 years ago (iirc) and it already received 4 os updates so far. The latest such update, received last month, was just 6 months or so after the previous os update.
But again, this varies from company to the other. I bought phones from Motorola and Nokia that they claimed would receive 2 or 3 os updates, but never delivered even a single one.
Better than Google themselves when last I checked, which is shameful.
That said, I don't trust Google, and would recommend filling out the arbitration optout form when you receive the device.
Do you assume you'll have some issue with them that will be worth individually suing them for?
Arbitration clauses and class-action waivers universally favor the corporation -- in this case Google -- and should not be legal. I'm proud to retain my basic legal rights.
[1] although they have in past updated very old phones when something really bad has happened.