I used to use Xiaomi's flagship and it seemed to have fairly regular updates, but every time I installed one it would replace all of my preferences and default to using their own replacements apps instead of stock Android apps that I preferred. I finally had to get rid of it way before the end of its useful lifespan because there there seemed to be a whole lot of issues surrounding its customization of Android. The deal breaker was after an update when I stopped receiving text messages reliably. Sometimes they'd come through immediately, sometimes a few minutes late, and a few days a week they wouldn't come in at all until either 1) I rebooted 2) I lost and then regained cell signal 3) I airplane mode on then off.
I tried all sorts of work arounds, suggested fixes from browsing forums, etc., nothing worked. I liked the phone, but it just got too stressful for work: My boss is respectful of normal business hours, but during the day still relies heavily on text messaging for requests, urgent issues, etc.
I was pissed off at having to put out money for a new phone so early, so I went with the budget Pixel 4a, and honestly I don't see much of a performance hit at all, even though it's about 25% worse on CPU specs. And even though the camera specs are much lower, it takes much better photos. At this point, I'm a convert to 2nd tier Pixel phones.
I believe my next phone will be a glorious fruit device, probably a second hand one.
The problem is compounded by the fact that every manufacturer has their own schedule for security updates. Just because Android got a widely publicized security patch doesn't mean that their phones will get it any time soon. By the time they do, nobody remembers what it's for.