Get a somewhat popular/high volume phone with an unlockable bootloader. You'd be surprised how long some phones continue to receive security updates through 3rd party Android projects, even after they are obsoleted by their manufacturer.

Check: https://wiki.lineageos.org/devices/

Bonus if you get a highly repairable phone which is unlockable and well supported by third party Android projects.