If you're really on a budget you can probably go back even more generations and get both an acceptable phone and one that'll get updates for some time. Which are probably more important for iOS because it's such a single big target compared to the fragmented Android world. I'm currently using an iPhone 6s I got in February 2020 for $200 from my Consumer Cellular MVNO which unlocks it after 6 months.

One thing you'll lose with the older phones sooner than iOS updates is AppleCare support, but if you get a good bargain to begin with....

When you do that you're also buying into a phone that will stop receiving security updates sooner since iPhones receive updates for ~5 years after they're released.

I wouldn’t really worry about that. Apple has been very good at giving security patches to old devices. Just a few days ago they pushed a security patch for iPhones as old as the 5S

https://9to5mac.com/2021/09/23/apple-releases-ios-12-5-5-for...

I'd wager that a 4-year-old iPhone will receive security updates longer than a significant number of brand new Android devices.