that updates are guaranteed for at least two years from the sale date
Who out there thinks 2 years is enough? If people keep using these things after 2 years, then they'd better get updates. I think 3-4 years is a more reasonable lifespan for a phone these days. At some point, of course, they're going to stop getting updates - and maybe they should lose their ability to connect to the internet at that point. But having them become disposable after 2 years makes them a lot less of a bargain.
That said, many of today's flagship phones don't provide much better support - in many cases worse. But that's no excuse for making Android One insecure and/or disposable. The whole point of Android One is to make sure that there's a secure alternative at the low end - rather than the utter crap that's being sold into that market now.