If you want to use a phone for 5-6 years while retaining a decent level of security, buy an iPhone XR. You don't have other options. Please stop using insecure old Android phones and don't bother pretending that ROMs unable to ship full security updates change that situation...
Conversation
Replying to
What about Nokia phones developed by HMD? There is talk of two years of letter updates and three years of patches, but I can't tell, if it's 2+3=5 years total, or 2+1 = two years of letter updates within the 3-year span of patches.
1
Replying to
It's 3 years of updates in total, without the most recent major release of the operating system for the final year. Pixels are similar but have 3 years of major updates guaranteed rather than only security updates.
There's also more to security than just these security fixes.
The monthly security updates provide basic security hygiene. It's a joke if devices are vulnerable to hundreds of serious bugs for long periods. Deployed software / hardware mitigations, attack surface, SELinux policy, etc. is important alongside the security updates of course.
1
There are some other Android vendors reliably providing the monthly security updates and not destroying security with tons of added attack surface and poor quality code, but unfortunately there aren't other Android devices keeping up with mitigations and hardware-based security.
1