[plttn]

The alternative is the iOS update process, which has the result of non-techies complaining that their iPhone 4 is now slow after the update, and the techies they know pleading with them not to update even though the number gets bigger.

[xorcist]

Another alternative would be to keep releasing security updates. If open source projects can manage more than three years support, it's not out of the question for Google to do it, at least for the major versions.

[moosingin3space]

I'm using a Galaxy Note 3 with CyanogenMod 12.1 (Lollipop) and I get each month's security updates. So it appears as though Google does release security updates for existing major versions.

[kartickv]

You mean issue security updates for multiple major versions, like Marshmallow, Lollipop and KitKat?

That's an overhead to code, backport and test. These resources could be spent elsewhere.

[saint_fiasco]

Do old versions of iOS receive security updates?

[kalleboo]

iOS 6 got an update for goto fail even after iOS 7 was out, but that's the only time they've done it I think. I think in that case it could have been because they still had in-warranty devices that didn't support iOS 7