I think phones should get security updates for at least 4 years. Quite a few people use them that long themselves, as I have in the past, but even more people get them used from others, which means a phone gets to be used for 4 or 5 years pretty easily.

Those should shouldn't be affected by a myriad of security vulnerabilities that come up by then just because they are poor and because companies would rather have planned obsolescence. It's the digital divide between rich and poor. The rich get security if they buy a high-end phone every year (if we are to consider Android's average security update lifetime), and the poor do not.