That's not up to Android, that's up the OEM. Android is constantly updated with the latest security patches. These are the companies who independently decide how long their devices receive updates.
I agree that many OEMs don't offer long enough support for their android devices. Luckily, virtually all android devices are supported by an open source fork of Android thanks to the AOSP (which Apple would never offer) and most android phones are designed to work with alternate bootloaders/OSes without the need to jailbreak. So when an iPhone hits its end of life, it's a brick; when an android hits end of life, it's still perfectly usable.