Why do phones stop getting software updates, and what happens then?
Because supporting a device costs money indefinitely while it generates revenue once, and because the support chain involves parties beyond the phone maker.
Why support ends:
Chipset vendor support. This is the constraint most people do not know about. Android manufacturers depend on the processor vendor providing updated drivers and firmware for new OS versions. When the vendor stops, the manufacturer often cannot continue even if willing. This is a major reason Android update windows were historically short, and why Google's and Qualcomm's extended commitments materially changed things.
Cost. Each supported model requires testing every update against its hardware, carrier variants and regions.
Hardware limits. Newer OS versions eventually assume capabilities older devices lack.
Commercial incentive to sell replacements, which is real but less decisive than the first two.
What actually happens when updates stop:
The phone keeps working. Nothing switches off.
Security vulnerabilities stop being patched. This is the substantive risk. Newly discovered flaws remain permanently open, and they are publicly documented once disclosed, which makes exploitation easier over time.
Apps gradually stop supporting the OS version. Developers raise minimum requirements, so apps stop updating and eventually stop installing. Banking apps are often first to drop old versions.
Certificate and protocol expiry can eventually break secure connections.
How long you get. Apple has typically provided five to seven years of iOS updates. Android varies enormously — some budget devices get two years or less, while Google and Samsung now commit to seven years on flagship lines. Check the stated commitment before buying; it is the largest hidden difference between similarly priced phones.
Mitigations: keep apps and the browser updated, avoid sideloading, use a device with a longer commitment, or install a supported custom ROM where possible.