As far as I know, google doesn't have an official policy on how long they provide security updates, but it has pretty consistently been 3 years after release.
The only reason old versions are still in use is that most vendors release a phone, give it the bare minimum number of updates, then abandon it when next years shiny new model comes out.