What are the hurdles that prevent upgradability? Terrible title, so I'll elaborate, and if you have a better title go ahead.

Currently many people I know are stuck on older and vulnerable versions of Android for one of many reasons.  Let's assume for a certain population of less savvy users, the steps necessary to move to an open source Android version to overcome these hurdles is outside of their comfort zone.

I'm lost on what canonical advice I should give them for making intelligent decisions about phone choice in the future, such that they avoid such a situation.

For one, the focus of this question: 

What factors lead to situations where a user will at some point no longer be able to upgrade Android on there phone?

I understand superficially some factors.  For example, the device manufacturer(or sometimes phone carrier) may have forked stock Android, and therefore they must integrate new versions of Android into their code base, test, and then push to their users.  This often leads to older phones, even those as new as a year, to be essentially abandoned where the manufacturer(or phone carrier) stops doing the work to release updates.

So factor 1: Manufacturer customized android.

Are there other factors?  

I speculate that even if your phone comes with stock Android, there could be hardware incompatibilities with future versions?  Is it possible the manufacturer's hardware may have an issue with a future stock Android version.  Perhaps this is why manufacturer often have customized versions of Android, so they can control the pushing of updates only after they've been validated against there hardware.

I would hope however, that there are reference standards for the hardware such that the core stock Android is able to make assumptions that ensure upgradability.

I think I may be using the term "stock" incorrectly though.  I think if you are not pedantic, it is clear what I mean from the context.  Any suggested edits are welcome.
http://m.androidcentral.com/why-you-ll-never-have-latest-version-android
-Manufacturer don't want to update "older" phone's because they want to sell new ones 
-provider's/network-operators 
They have to check everything again 
Civil safety against bad mobile phone radiation