The Nexus 5 was released October 31, 2013, making it almost three years old (at least it's three generations old - after 5 came 6, then 5x and 6p - now the Pixel its de facto successor).
What is more relevant than when it was released is when it was last sold as a new device through official channels. If a phone is for sale though a legitimate distributor, then I think it's reasonable to expect security updates for 3 years after that point.
