It also can be a bit hit and miss, depending on the device. Might the maintainers decide to buy a new phone and then that one no longer has support. Sure. They also cannot provide the proprietary firmware updates necessary to keep the device completely secure.
I wrote about that some time ago Stock Android Guide - #7 by dngray.