Google release security updates for supported versions of Android monthly.
It’d be really nice to get these released regularly for the PPM, albeit with some delay for integration and testing.
To date, the only devices I’m aware of that get these updates regularly are the Google Pixel phones, and all Nokia Android phones.
Nokia do them for three years from when the phone is released.
Personally, I’d be happy to pay a small amount every year after that to continue receiving updates for as long as Google keep producing them.
Security is important, but throwing away good hardware because a manufacturer can’t be bothered to support it is madness (and is unsustainable ecologically).