If I buy an Android phone today and want security updates for as long as possible, how should I choose a phone? I'm willing to use custom ROMs.​
The Dutch consumer organization retests their smartphones periodically for updates: https://www.consumentenbond.nl/acties/updaten/ruim-een-derde-smartphones-heeft-sterk-verouderde-veiligheidsupdate

The list is basically: the Google Nexus/Pixel phones (~3 years), Nokia / HMD Global, last (&amp; this..) year's flagship Samsung (~1.5 years), this years flagship Sony Xperia.

(These phones had the February 2018 update begin March)

In the mean time iDevices are updated for up to 5 years (4 years + security updates until next iOS). This makes them cheaper year-over-year over the lifetime of the phone.  Please see the "Depreciation" and "Sources" worksheets in this Google Sheets workbook.