That's fair. I feel like it's quite manufacturer dependant now, and unfortunately if you don't look beforehand you can end up with a bum deal in that regard.
Samsung are good in that they'll now update their phones with 4 years of Android updates, plus an extra year of security updates. Google are similar, but I believe they do 3 years of Android updates and 1 year of security updates IIRC. Both of these work fine for me as I run a 3 year update cycle, but I'd feel like I got shafted if I got something like the ASUS Zenfone 9 which only has 2 years of updates promised.
It's no secret why there's still so many old iPhones kicking about when you consider how they're still getting updated. I think the difference though is that Apple makes money off of you being in their ecosystem, whereas a manufacturer like Samsung, Asus, etc. make pennies if anything at all.
Personally use this, hasn't let me down yet!