Cheaper phones rarely get more 2 software updates, and security patches can take years to roll out. This is mainly because manufacturers have no incentive to spend money on patching/updating software that a small number of people use. https://www.statista.com/statistics/271774/share-of-android-... Google is working on a new OS for the pixel which will attempt to solve this fragmented Android issue.

I believe Android has gotten better about pushing security updates, at least to most flagship phones. But they still lag behind on OS updates.