So, in some company if people want to use a phone for any work related business, it should be a phone with 3+ years of promised security updates from manufacturer. So, either an iPhone or a Pixel. Or Android One program. No, they don't buy you one. No, you are not compensated in any way.

A: 4 years of updates, but always 6 months delayed.

B: 2 years of updates, but in a (kinda) timely fashion.

So you could only use phone A for 4 years instead of phone B for 2 years? Very secure. Who cares how long it will be supported if you have to pay it out of your own pocket anyway?