There are OS updates and there are security updates. Check with your manufacturer as these periods may be quite short, and considering how tied our finances and porivate info are to our phones, it could be a huge hazard. Most android manufacturers, for example, I think offer 2 years of OS updates and 3 or 4 years of security updates. Apples does 6 and 8 - which is wild to me for all the talk of Android users about FOSS and privacy and security. Samsung does 4 and 5, which IIRC, is one of the highest in the android world.
I’m certain someone will mention GrapheneOS, so let me get ahead of that: You can completely de-google your android phone and get as many years of OS upgrades as your hardware can physically support… but is the average person really going to do that?