I think that the problem is central to how phones are developed and constructed. Dell doesn't determine how long my XPS 13 gets updated; they provided the hardware, and I can put any software I want on it. It can keep running a secure, up-to-date OS as long as I want it to, until the hardware truly can't keep up (which, based on computer lifetimes these days, is a long time).

Conceptually, I dislike that mobile development hasn't followed a similar path. Samsung should not dictate how many updates my phone gets and for how many years. Practically, I realize that this is a consequence of how we've built SOCs and mobile hardware and there's no incentive for companies to change. That doesn't make it less problematic.