> If it doesn't get security updates, you really can't do online paying/banking with it.

Maybe you shouldn't, but in terms of pure ability you perfectly well can. (And somewhat ironically, if you take matters into your own hands and update the OS yourself, quite a few banking apps will then refuse to run for "security reasons", while at the same time they're absolutely happy to run on an outdated OS version.)

That’s mostly true for any Android phone after a year or two - or sometimes never.

All Android phones have shitty long term support - even the Pixels.

Of course iPhones are a different story with Apple releasing a security update for the 2013 iPhone 5s as recently as June of this year. But I’m not going to suggest an iPhone as an alternative.

On the other hand, developing countries manage with $30 unsubsidized phones and people use them for banking.