How long can I reasonably expect security updates to be supported? In light of the recent "stagefright" MMS vulnerability, I understand that while Google may release fixes to security vulnerabilities, it requires co-operation from the handset manufacturer to deliver those fixes to handsets.

As the owner of an aging Samsung Galaxy S2, I'd like to know if I'm ever going to get an update. No-one ever told me that my handset was no longer going to receive updates. Maybe it still is but Samsung are still working it out.

How long after a handset has been made should I reasonably expect security updates to be pushed out? At what point should I seriously consider replacing a handset if these updates are important to me?

Related: https://windowsphone.stackexchange.com/q/10068/13848
It depends on your manufacturer and carrier to deliver the update.  My guess is that it would only be the newest models or this past year's flagships that would be updated in a reasonable amount of time.  

If you have the understanding and really want the update, I know many of the custom ROM's will be updated well before any of the carrier stock images. I checked yesterday and my phone received an update in a nightly build about 2 weeks ago.  Check and see if your device is supported by Cyanogenmod.