Google is no better for their own phones with their 2 year update window.

And good luck if a manufacturer decides to breach contract, e.g. TI, they won't enforce the updates.

This honestly in general has me leery of Android as an ecosystem in general. I also don't like iOS's approach in other realms either. So it's essentially stuck between a rock and a hard place.

In general avoid obscure models, more popular hardware generally have much better community support and development. Having an unlockable bootloader is a bonus but not essential in all cases.

That's why I bought a Motorola flagship phone when they were owned by Google, with very few custom OS changes beyond ASOP... I've been bitten at least once by most mfgs at this point, HTC, Motorola, Samsung.