Most android phones only receive 1 or 2 years of updates since release, not when you buy the phone. If you get it 2 years after it was originally released, chances are you have at most 1 year of security updates and little chance of getting a newer version of Android. https://www.theverge.com/2018/10/24/18019356/android-securit...

The only exceptions to this I know of is the Pixel lineup (Pixel 1 got Android 10) and "Android One" phones https://www.android.com/one/, although this only guarantees 2 years of OS upgrades and 3 years of security updates.

> Monthly security updates to be supported for at least 3 years after initial phone release