Yes, sort of. Google depends on Qualcomm to make updated drivers, as Qualcomm owns the intellectual property. All Pixel phones are based on a Qualcomm platform.
Qualcomm stops supporting their processors after a few years, usually three. They can make more money by selling new chips. Although I say this cynically, Qualcomm is actually the best third party vendor in this regard.
They must have the source code for any chipset vendor kernel drivers due to the GPL so they could keep producing security patches, or require them contractually. Some other Linux vendors keep supporting old ketnel versions for 10+ years after all.
Linux kernel drivers don't have to be GPL though. There exist plenty of closed source drivers for GNU/Linux. The "kernel" on Android devices are a small open source kernel and a huge amount of closed source blobs for wireless connectivity, sensors and the GPU.
That legal interpretation has been contested a lot. In any case that wouldn't be a blocker for providing security patches to the kernel, just like other LTS Linux distributions do.
Since Google supports Pixel devices longer than the three years Qualcomm gives or used to give, they're probably already doing that. Not saying they care enough, but they care more than any vendor besides Apple.
Qualcomm stops supporting their processors after a few years, usually three. They can make more money by selling new chips. Although I say this cynically, Qualcomm is actually the best third party vendor in this regard.