Each device has a different support period based off of Google’s official schedule, check devices here.
Both Google and the developers of the alternative operating system provide updates to the phone. Google provides updates for the drivers, firmware, and bootloader. They also provide security updates to the operating system which are implemented by the developers of the alternate operating systems.
When Google’s official support period ends, you may continue to get updates from the developers of the alternate operating system during an extended support period. This includes all the open-source components of the phone including the kernel and operating system.
After the support period (and extended support period) ends your phone will continue to work as normal and maintain privacy, however new security vulnerabilities that are discovered may not be patched. For this reason we recommend you purchase phones with longer support periods.