What did happen about a year ago is google moved some of the communication framework stuff from android proper, and rolled it into 'google play services' so that it can be updated independently of the version of android on your phone.
As a result, apps like hangouts, plus, maps, the dialer and others which rely on those frameworks can be updated to use the newest version of the framework without worrying about the whether your population of phones have been updated to android x.y, any phone that has the play store installed and updated should be running a recent version of play services.
Given how much many people depend on their phones and how much information they usually have on them, I think security is pretty important.
That's why I got a Nexus 5; I'm confident I'll continue to see updates for some time.
Google really needs to include in their play store agreement some kind of requirement to ship critical security updates within a defined period of time. Yes, that's going to hurt - the maintenance burden of shipping an Android phone is going to rise dramatically if you inherit a burden of 5 years of updates. But then, critical security updates should be extremely incremental updates that rarely involve any functional changes to the user.
I'm not sure how the Android ecosystem is sustainable without something like this. At some point there will be an Android security apocalypse: an exploit that can't be fixed without a kernel update that affects hundreds of millions of legacy phones that have been abandoned by their makers.
Google has to deal with a million different devices that are the same age as the iPhone 4, and their only "blessed" one, the GNex, doesn't exactly represent a large portion of their market... so they can't code up special tweaks and hacks for the OS to make it play nice on those the way Apple can do with the iPhone 4.
Until the break-neck pace of mobile development slows down or Google gets real traction with a Nexus phone, I don't expect this to change.
If 2 years of OS-level upgrades isn't enough, then Android isn't for you.
OEMs and network operators are just playing the same music they used to play with their proprietary mobile OSs.
Apple managed to work around that, but I doubt any other will be able to.
Pretty much impossible to predict. The safest bet is to either buy a Nexus phone (Nexus 4, 5, etc.) or maybe the GPE of a phone (S3, One, Moto X). Google stopped supporting the Galaxy Nexus so people were a bit miffed about that.
The good thing with Android is that even if your manufacturer/carrier decides to stop supporting your phone, you still have the opportunity to flash an updated ROM via third-party developers. Granted the performance probably won't be the best but at least you still have the option as opposed to iOS.
Unfortunately it only has like 384 MB of RAM or something like that, so many apps are problematic on it (e.g. I've had problems with the mobile versions of Firefox and Chrome, which need at least 512 MB). I do understand why Samsung stopped supporting it after Android 2.3 though. The phone's specs just can't keep up. I can say the same thing about an iPhone 3GS that I've got lying around.
Now I have a Nexus 4 and I can say that the best Android to get is always the latest Nexus - good hardware specs at a good price and it's the reference. Even if Google stops supporting it, heck, if CyanogenMod still supports the first-gen Galaxy S, then you can bet that it will work on a reference Nexus phone for a long time.
It has something to do with the screen latency and bunch of other factors.
I've been using android for a while now but with the need for everyone to have their own UI on android and the lack of carrier updates I think if I can't get a Nexus phone for my next phone (would be a carrier issue) then I would probably go back to iOS.