I should have said up to three years but you are even more incorrect --> https://android.googleblog.com/2015/08/an-update-to-nexus-de...
Although those security updates have been out for a year now, so technically Google doesn't update their phones for three years yet and we're yet to see this commitment happening. Based on their track record, my confidence level isn't exactly high.