FWIW, the linked article doesn't track security update status at all. It's graphing percentiles based on API version, which correlates only weakly. A vendor with a correctly patched but old OS would show up as "out of date", but one that missed or is late on important security updates on a recent version is "current".

Do vendors distribute security patches?

Right? It may still largely be functional, but I would never trust that device in the open, it's just ripe for a bevy of attacks.

I really wish Google would expand their service lifetime on their own devices, because I feel 2 years is really too short.

Two years is completely too short, even three years if you purchase mid-cycle is not enough.

I own Nexus 5X's on Project Fi, one bootlooped and was replaced, the other still going strong after ~20months. I also have a Pixel XL acquired like 7 months ago, both of those should outlive the updates and giving Google the money directly, they should take care of their customers.

Far from an Apple fan boy, the 2016 MBP and 2017 iPad do not worry me about getting forgotten in the ever ongoing updates.

Two years is too short but once you get on the extended warranty loop you can basically get another 2/4 years of new phones on the cheap.

For the 5X's, the were a great deal, and it would cost more than the phone to get into the extended warranties. Not worth it for our purposes. As long as they keep working, we'll keep using them.

It is 3 years now with the new pixel. Still too little in my opinion.

If you genuinely only use the phone features of the phone, that doesn't matter anywhere near as much. You only need to update if someone finds something like a text messaging buffer overflow. That sort of thing generally makes the news these days.

You can but hope that once it’s old enough, the hackers will stop worrying about supporting it.

When "the hackers" consist of the CIA and NSA, you can be sure that they will not.

Take a quick look at the Vault7 leaks for a reference.