[xorcist]

Another alternative would be to keep releasing security updates. If open source projects can manage more than three years support, it's not out of the question for Google to do it, at least for the major versions.

[moosingin3space]

I'm using a Galaxy Note 3 with CyanogenMod 12.1 (Lollipop) and I get each month's security updates. So it appears as though Google does release security updates for existing major versions.

[kartickv]

You mean issue security updates for multiple major versions, like Marshmallow, Lollipop and KitKat?

That's an overhead to code, backport and test. These resources could be spent elsewhere.