So if your (example) Samsung device gets updates for 2 years, then the planned obsolescence for that device is 2 years + a few months. The amount of months depends on the severity of the security issues discovered. Also, it may not be "planned" obsolescence, but it sure is "accepted" (from the vendors point) obsolescence. Which is even worse.
On a side note, as a customer I don't care about internal structures of companies. I want updates. If they can't deliver that, open source everything.
And most Android manufacturers are hardware companies - their margins are too thin to support/maintain the software side of it. 90%+ of their R&D budget is hardware. It's the same as HP's computer division. No they are not a software company, they use MS Windows as the OS and make sure the correct drivers are present/integrated. This is exactly the same on Android. They buy off-the-shelve chipsets, integrate their drivers - which are developed by the chipset manufacturer - into Android, pour over some crappy GUI customization, in many cases developed by a 3rd party, and they're done.
The software update case you wrote is a good example of planned (or accepted) obsolescence by the developer.
Supporting/updating devices requires active planning, but then you get cries over companies that actually do perform updates and get the whole 'planned obsolescence' conspiracies.