3 years is ok, but ....
It has to be from date of purchase, not first release. If you are selling these things still in 2016 then you should be still patching them to 2019, even if a particular phone was purchased in 2013.
Windows Vista (released 2006) only ended security patch support a few weeks ago. (And even then you can still wave about a large wad of cash and get updates). Why can't phone makers do the same? If it's a cost thing, I would have paid an additional $100 for "guaranteed monthly security patches for 5 years".
Biting the hand that feeds IT
