Most importantly Xiaomi broke rule of 90 days for security patch age. They should get some penalty from Google for this, otherwise no OEM will ever care to update anything.

I have April security update on my mi a2 I don't understand why you said that. I have 3 years now this amazing phone and I am getting all updates, its like a pixel literally with this clean os.

I've received the April Security update on my Xiaomi Mi A2 as normal.

I don't care about their update. Since the last official update, my phone remains the same, it has the worst ram management. It keeps killing my app in recent apps. So I decided to use custom ROM from then, and it's performing at its best from then.

I not received security updates on my Xiaomi Mi A2 Lite for 2 years. I'm very disappointed.

I have a Mi A2 and received the security update of April normally.
The point is that Google had left Android One program to die: Computerworld published an interesting article about that (see "What the hell is happening with Android One?" in their page)
So, I think that it is not only Xiaomi's fault.
And yes, they are pushing us to buy a new phone, we all know that... but, unfortunately for them, I'm still satisfied with my phone.

I noticed that my cheap Nokia 1 got two updates since my Mi A2 last had one. Bye bye Xiaomi, back to Nokia I go.

It would be the final nail in Xiaomi's credibility if they did not comply with the terms of the Android One program: two years major upgrades (expired) and three years of security updates (still ticking).

We have a major vulnerability in the Qualcomm modem that needs to be patched, there is no way Xiaomi can pretend there are no security updates to be made.