Android(Non-Nexus) is a toxic hellstew of surveillance and security vulnerabilities.
I'm currently recommending iPhones or Nexus only to my friends.
Google could do a lot to improve this but the carrier relationship with handset manufacturers allow them to MITM the CA systems through root certs and that is god damn unacceptable.
Two years of OS updates (2 major OS versions, since they do them yearly now) + another year of security updates seems quite ideal and I'd hope more OEMs adopt that. Unfortunately even if they do, they won't do it for all of their phones, only their flagships, which means lie 80% of the Android smartphone population won't benefit from it.
As someone who has recently had to support some Windows XP systems, I have to say Microsoft has set a high bar for support. XP was released in 2001, received major updates for 7 years until 2008 with SP3, and received security updates until 2014, a total of 13 years. Some customers are still receiving special security updates.
While Windows XP is not exactly a desirable OS in 2015 for many reasons, its sad that 3 years of security updates is seen as progress in the smartphone world, and I say that as an Android user with a perfectly functional phone facing EOL this year (a 2013 Nexus 4). I'm hoping google can wrestle enough control from OEMs and carriers to be able to support their OSs for 5+ years with at least security updates. Its not without precedent, they supported Chrome on XP until at least this year -- on a 14 year old OS.