Qualcomm and Google team up to offer 8 years of Android updates

Google sticks to their promised update lifecycle (which was 2 years for some devices, but 7 years after release for recent ones). Samsung seems to have a decent support lifecycle too these days, but I've noticed that at the end of the lifecycle Samsung tends to switch from monthly to quarterly updates and not all security patches are always included.

For other vendors, the vendor does need to actually put the Qualcomm code in new updates. If you buy Oppo or Sony, that means you may not receive updates despite the SoC and upstream Android being supported. On the other hand, Google has been pulling more and more components out of base Android so they can be updated independently, so it's possible things like GPU drivers may receive security updates even if vendors stop supporting phones.

However, with this news, willing vendors can provide prolonged support, so as long as you verify on the vendors' web page that you'll receive updates, you'll probably get them ("vendor" including the brand, but also the carrier if you're buying a phone through a carrier for some reason).