They do, actually, via the Open Handset Alliance and Google Play. They are tied by what Qualcomm is willing to deliver in their BSPs, and that's basically 2 years of Linux LTS kernels. So the minimum support level is 3 years; two Android versions and one year of security patches.

Samsung and Google can do 5 years of support because of Exynos/Tensor, and Samsung basically spends the money to support older Qualcomm devices themselves.