"With a Sony flagship from the last 18 months for example, you usually won't run more than two months behind on security updates."

That's still truly terrible compared to Apple's legacy device support. iOS 11 and future patches still support even the iPhone 5s, a phone from 2013.