Call-out to Sony (was: Re: Oh well)
Gotta give credit where's it's due. I have a Sony Xperia (XZ Premium from June 2017) and a week or so ago got the firmware update to the January 2019 security patch level. I started on Nougat/7.1, then upgraded to Oreo/8.0 and now on Pie/9. It never lagged security patches by more than about two months. My previous Sony handsets also got regular updates, up to and sometimes past two years from launch period.
Sony also publishes publishes build instructions and newer kernels for devices long past their two year support cycle for third parties who want/need to make custom builds