Android security updates are the only reason to update my Nexus 5. A decent midrange phone, with an open bootloader, would probably do me for many years.
It gets the monthly security updates. I guess I worry about the binary blobs that vendors may or not be updating but that's true of any hardware no longer receiving updates.