Android manufacturers, unlike Apple, don't really earn much via the software - so there is really no reason for costly updates which keeps the customers from buying the next phone..
It's unfortunate that lack of updates don't prevent customers from buying the current phone.
It feels like we need consumer protection laws that require companies to prominently advertise the software "warranty". So Google and Apple can put "5 years" on the box and Asus needs to put "0 days". The problem is that it isn't something that most people think about. But when you point it out to them it definitely changes how they evaluate phones when you show them that this one will be dangerously insecure after 1y but this other one is good for 3y.
