But what's the alternative?

Apple. Say what you want about them, their update policy is clear, consistent and fast.

Does Apple announce each model's end-of-life date (in terms of security maintenance) in advance?

As I understand it you generally have 5 years for hardware and software support with software requiring that you upgrade to major versions as they're released for continued updates. Perhaps someone can share a link or provide better details for software support/EOL info?

Here's their vintage/obsolete products info page: https://support.apple.com/en-us/HT201624

As an ordinary consumer using my phone, how would I know when it's going to become unmaintained and I'll need to buy a new phone (if I want to continue having security maintenance)?

This is one thing I think Linux distros could do better: not just advertising upgrades to the next release, but warning when the current release is (soon to be) no longer maintained.

They don’t announce it, but based on their current cycle, which has been going on for at least 5+ years, they drop support for an “A” chip every year. Currently the last chip to lose support was A6, so you should get about five years out of an A11.

They will force you to update your battery? Don't let their bad policies cloud your judgment....

For those that can afford it, iPhone.

I have a few WP devices that had more updates than all my Android systems together.

Until Google gets really starts forcing the OEMs to provide updates, nothing will change for the regular users.

Treble is not the solution, as the OEMs are the ones that should provide the updates and certification is only required if devices are actually shipped with 8.0.

Of course technically inclined users will just root their devices, assuming they are willing to trust random downloadable firmware blobs.

>For those that can afford it, iPhone?

Hmmm. Current new iPhone 6s - $449, SE - $349 and plenty of used and refurbished options from $300.

Last year I got a brand new 32GB SE from Walmart for $140, locked for a year of $25/month minimum usage, although I'm just using it as an iPod touch replacement, i.e. not using it as a phone or paying monthly.

Not everyone lives in US with US level salaries.

Also some people like to have the opportunity for once on their life to buy brand new things.

I went with Windows Phone.

http://blog.hackensplat.com/2017/10/windowsphone.html

Despite other legitimate grievances, iOS devices have a much better track record of receiving updates.

Flashing a custom ROM I guess. Most are made by enthusiasts, so while amazing, there are no hard guarantees about performance and security.

Despite that, a custom ROM feels like having a modern device again. All the marketing-driven little walls are gone.

get a Xiaomi Redmi Note 4 with snapdragon 625(mido) and flash LineageOS on it (but don't do it on April 1st, and don't install Google's Play services)

Libram!

Even assuming you meant Librem, where can I buy a Librem device? After sending the money, I have a tolerance of 21 days until holding the device in working condition in my hand. Any offers?

maybe eelo.io

Did Lineage OS not ship a fix?

Entirely possible that he had a US phone which was not easily rootable/flashable.

Most common phones like Samsungs are though.

Are you kidding? Maybe the earlier Samsung phones, sure. But ever since the Galaxy S6, Samsung phones with Snapdragon CPUs (i.e. all the US models) have had locked bootloaders that are notoriously difficult to circumvent. Pretty much all custom ROM development on recent Galaxy's are aimed at the International Exynos-based processors for that reason. The GS8 even takes it one step further, where if the phone detects it has been rooted, it will cap the battery at 80% charge.