And my Galaxy Nexus stopped receiving updates 2-3 years ago despite it being a Google device (mine was also straight from the Google store, so it wasn't the carrier's fault).

Cyanogenmod supported the Galaxy Nexus until 13.0 which is Android 6.0.1. So Google just dropped support after 4.3 (coincidentally the last unsupported version) even though it was absolutely possible to update to newer versions of Android. As a result the Galaxy Nexus doesn't receive security updates from Google and is thus not usable as an online device.

if i recall the galaxy nexus was dropped just after 4.3, if i recall correctly this was due to Texas Instruments dropping out of the modem game no?

that was the last android phone I owned.