How long can I reasonably expect security updates to be supported?
It depends on your manufacturer and carrier to deliver the update.  My guess is that it would only be the newest models or this past year's flagships that would be updated in a reasonable amount of time.  

If you have the understanding and really want the update, I know many of the custom ROM's will be updated well before any of the carrier stock images. I checked yesterday and my phone received an update in a nightly build about 2 weeks ago.  Check and see if your device is supported by Cyanogenmod.