There's no way I'd buy a used Android phone, unless it was from Google and was less than two years old. Android phone makers are terrible about security updates.
Actually things have improved considerably this year. You may still not have the latest OS version, but the security patches are arriving every 1-2 months.
Oreo is supposed to improve things even further, but for know its just a theory.
