This is a budget phone, so there are very few people who would purchase extended security support after three years. There certainly won't be enough to cover the business costs for keeping the support and testing of an old crufty phone used by few people.

It's unsustainable to put the costs on the backend, so phone's price would have to be raised to cover those extended security updates. But, that won't happen for a budget phone. There just won't be enough people willing to pay after three years.

That's the problem with purchasing a budget phone. You get what you pay for, a phone that will go away soon.