If lengthy period of software and security updates is high on your priority list, is there any point looking beyond Google and Samsung (when it comes to choosing an Android device)?
Do any other Android device makers match or come close to these two on duration of updates?
Correct. If updates and device longevity are important factors, there's no point getting anything other than Samsung or Google.
OnePlus is not consistent, and they have blatantly broken promises in the past. I'm surprised that there are still people supporting this company after all the things they did.
Samsung is currently the gold standard imo. It's easy to provide long support for $1000 devices, but the challenge is in the lower end, and Samsung even gives at least 2 years of OS updates and 4 years of security patches (albeit either quarterly or bi-yearly) even on their cheapest devices.
The wild card is Nothing. They promised 3 years of OS upgrades and 4 years of security patch. It's still behind Samsung for the price they're charging, but it's quite good amongst the Chinese OEMs.
Imo the main problem is Google's own certification process. To get Android handsets certified, Google only require 2 years of quarterly security patches. Thus many OEMs are operating at just the minimum requirement.