But many people use budget phones for years and never receive a single update or upgrade.
Heck, even people with flagships from some manufacturers hardly get any significant updates!
In general, I'd say you're fine for another year or so. Just keep an eye out for legitimate security concerns in the news. And I don't mean the FUD that antivirus companies do press releases on, like that recent story about the Xhelper malware that keeps coming back despite hard resets (and oh by the way, you can only get it if you go to a shady website to sideload a shady app for shady reasons, but that part of the story isn't emphasized). I mean security concerns that Google actually acknowledges and specifically addresses in a security update.