Background

Quite a few software developers offer special "long-term support" (LTS) or "extended-support release" (ESR) editions of their products. You install the product once and get security updates for up to ten years, without having to upgrade to the next major version of the software.

Here are some examples: You can install one version of Firefox ESR and then get security updates for version for about a year. Or you can install one version of Ubuntu LTS and then get security updates for that version for five years.

Unfortunately, Google doesn't offer a special long-term support edition of Android. Security fixes get backported to your device's Android version until Google stops backporting them. These patched Android versions get built into new firmware images for your device until your device manufacturer or third-party ROM builder stops building new images.

(For example, it looks like Android 6.0.1 "Marshmallow" is still getting security fixes. The latest versions of Android 6.0.1 are android-6.0.1_r56 through android-6.0.1_r63. Each of these eight Android versions was released on the same day: on Aug. 1, '16. Each of the eight was designed to support a different set of Nexus devices. Device makers can pick any of the eight and then port it to other Android devices. As of this writing, it looks like Android 5.1.1 "Lollipop" may also still be getting security fixes. The latest version is android-5.1.1_r38, which was released July 19, '16; it may also be known by the build code LMY49M.)

iOS

Apple tends to support iOS devices for three to five years after their initial release. (Source.) They ship both new features (which slow down your device, thereby encouraging you to upgrade) and security updates. But I want a device which is more open and expandable than an Apple device.

My question

If I'm buying an Android cellphone today, and I want to get security updates for it as many years as possible, how should I choose?

(Monthly security updates are nice, but today I'm not asking about monthly security updates. My question is not about which Android phones get security updates the most frequently. Instead, it's about which Android phones get security updates for the greatest number of years after purchase — even if I must wait six or twelve months between updates.)

Please don't recommend a specific make and model of mobile phone and leave it at that. Such an answer would be useful to readers today, but not to readers who view this question a few years from now. Instead, please tell me how to compare products myself. How important is it for me to choose a best-selling device? Does it matter whether I buy a midrange phone (US$100-$200 with no contract) or a high-end phone ($600-$800 with no contract)? Must I choose hardware from manufacturers who get their drivers into the Linux kernel, and if so, which manufacturers are these? What other criteria should I use in order to make my choice?

Please assume that I'm willing to download and install custom ROMs in order to get security updates, but that I'm not willing to compile anything myself.

I know that you can't predict the future with perfect accuracy. Please just try your best.