I find it amazing that supporting a $1000 phone for 3 years is considered excellent. It's not very sustainable to make several billion new smartphones every 3 years...
But I agree that $500+ phones (Google AND Apple) should IMHO be security-supported for 5 years. It would be better for all of us.
A 128GB Pixel XL with device protection is $968 US before tax and still has the same 3 year support as the entry level Pixel.
The fact is Google sells a $1000 phone with 3 years of support. They also sell less expensive variants with 3 years of support.
If you buy a phone that you know is already going to be obsoleted soon (it's not like Apple makes its release schedule a mystery), you should assume it will have less support than the latest model.
When phone vendors releases a phone, they can deposit the vendors custom binaries/source in google servers.
Google will maintain and release security updates for vendors for X number of years for Y amount of $$$/Year.
The phone vendors can snap a "Android Security Update Guarantee by Google until year ZZZZ" logo/label on the phone.
In a plateauing market where more customers buy their own phones, it could be a differentiating factor. As an iPhone user I buy an unlocked phone every 3 years or so, updates are therefore important to me -- but clearly not to enough of the Android market right now.