Security might be served much better with a more "LTS" Android that would give hardware companies less excuses to leave devices behind. Not only less excuses, but also less incentive to do so: "no more boring security updates" is a much weaker carrot to lure users to new devices than "no more exciting new sugary snacks", which usually also implies no more security updates anyways.