Re: Pixel only
I would certainly agree that it should be much longer than 3 years but the reality is that the majority of android phones out there are unpatched at the operating system level because the manufacturers and telcos don't bother with the updates.
Nothing incredibly bad has happened because of this. The stagefright vulnerability was a non event. The action is in the Apps.
That could all change overnight of course but until that happens there will be no pressure to change things and the 3 years of updates matches the replacement cycle of the majority of phone users.