In light of the recent "stagefright" MMS vulnerability, I understand that while Google may release fixes to security vulnerabilities, it requires co-operation from the handset manufacturer to deliver those fixes to handsets.
As the owner of an aging Samsung Galaxy S2, I'd like to know if I'm ever going to get an update. No-one ever told me that my handset was no longer going to receive updates. Maybe it still is but Samsung are still working it out.
How long after a handset has been made should I reasonably expect security updates to be pushed out? At what point should I seriously consider replacing a handset if these updates are important to me?
Related: https://windowsphone.stackexchange.com/q/10068/13848