FP2 still gets Android security patches - the main problem by now is that the drivers for the hardware are not properly updated to Android 7 (due to the manufacturer not providing any updates)
The Fairphone 2 can run Android 9 via LineageOS. The official versions (the one with and the one without OpenGapps) still get security updates. Can you say the same about Nexus 5X with Android 8.1?