There is an important distinction between promised lifetime and actual lifetime. For example if a CPU instruction-level issue was discovered Fairphone would ha

There is an important distinction between promised lifetime and actual lifetime. For example if a CPU instruction-level issue was discovered Fairphone would have no way to fix that without microcode updates. This means that a vendor can't guarantee security updates for longer than Qualcomm will offer low-level support. However the discovery of an explotable instruction 3 years after release is quite unlikely and as far as I am aware hasn't occured so presumably Google *could" continue updates in this case. Of course there is still consumer expection issues. If phones are usually supported for 5 years even though they only promise 3 you might feel cheated if your particular model has to stop at 3.5 years. There is also the option of ignoring the CPU vulnerability but continuing other security updates. However trying to explain this to users is incredibly difficult. Even if you can get their attention you have to explain the impact of being able to break out of the app sandbox to them.