Depends on what phone you get. Mid to high end phones usually have communities to maintain 3 party system patches for them after they are not maintained officially. You can still use it safely for a a few years if you even bother about it.

For example, my old sony xz3 is a 2018/08 phone with software update discontinued since 2020(?). But there are actually 3party roms that can update it android 12.

That covers most of the software, but basically every modern phone has some proprietary drivers that are necessary for it to function and that have security vulnerabilities of their own.

And nobody's going to exploit those device-specific vulnerabilities (that probably require local code execution anyway) unless you're a high-value target.