So here you / we have an open source environment in Linux.
Android OS is proprietary ex-Linux licenced to manufactures by Google to do what they can with it at their price point.
Meanwhile Google shares much not all of the code with AOSP – /e/OS users running a branch of AOSP.
-
Device users are in the hands of Vendors providing security patches. Once upon a time this could extend for as little as 18 months, now “green” benefits are seen and Vendor SPL are often currently quite long.
-
OS Google provides to AOSP Android SPL for “a few years”. It depends how you measure that length from initial or manufacturer’s release. [1]
So this is a lot different from the original proposal by Linus Torvalds on the 1970 IBM PC specification The IBM PC
If hard to answer a “General question” here is a “user story”. My “other phone” is a OnePlus One bacon built, one might say, for long life and Custom builds. [2]
It would take an /e/ historian to confirm this but I think supported from e-0.3 or thereabouts.
Vendor security patches stopped Sept 2016.
This will be the indicative date when manufacturer support ceased.
Currently Android SPL is Nov 2024 as I didn’t build myself an update since 
Technically running AOSP A13 it should be possible and have Android SPL of July 2025.
/e/OS support stopped primarily as the partitions as delivered were too small for the full /e/ system (can be fixed) and lately for other reasons in my case as “too difficult” requiring for instance ultra legacy from LineageOS.
[1] Alluded to and better told Article from GrapheneOS about /e/OS - #4 by Bowibit
Another angle Oldest phone with newest Android version (just for fun) – no general answer (from me).
If bought new in 2014 I would have got 11 years out of it, with /e/OS (including the spell with own Custom) for 90%.
My IBM PC built 2008 runs Debian 12 just fine.
But now reading your post below, perhaps I do cover the issue (at least in part) of why Updates are such a big thing and should really be taken “every time” if one intends to be “fully networked” as a smartphone tends to be. Two or more phones judiciously configured can help avoid fingerprinting.