What is more relevant than when it was released is when it was last sold as a new device through official channels. If a phone is for sale though a legitimate

What is more relevant than when it was released is when it was last sold as a new device through official channels. If a phone is for sale though a legitimate distributor, then I think it's reasonable to expect security updates for 3 years after that point.