GrapheneOS Thanks, I hadn’t considered that possibility. That does make sense, assuming Google are in control of all the driver binary blobs so there’s no restriction on upgrading to a newer kernel.
Does anyone know what other OEMs do? I see announcements from Qualcomm of 3+1 years and Samsung of 4+1 years, but it could be the +1 is just the remaining time of an annual release cycle (ie Android X released in October, supported through to the next September). Does any OEM offer more than 1 year of security updates, and how do they handle it?