I have to say I think this is an issue with Android; a few years ago I bought my first smartphone (a Sony), running Android 1.6, which was already old hat. I got a "free upgrade" to 2.1 when that came out and, er, that was it.
I used the phone for several years afterwards, but as you say, out of date OSes aren't great from a security point of view. I jumped ship to iPhone eventually, first with a 4S, then a 5S, then an SE. The Apple walled garden may not suit everyone, but at least it makes it easy to provide updates. The 4S can't be updated any more, but I think the 5S supports iOS 11, and it's a good few years old now.
What about a refurbished iPad mini? Have a look at the Apple store. My wife had her iPad mini 2 stolen in Prague last year, I got a replacement (mini 4, good as new, with full Apple warranty) for c. £260 IIRC. Should be good for a while yet.
Cheers,
Plug