https://www.mi.com/global/service/support/security-update-1....
The only exception is Xiaomi's Android One "A" line, which is now discontinued.
So if you want a Xiaomi and care about security, simply remove the bootloader lock and install LineageOS. Some models are officially supported by LineageOS.
LineageOS provides timely Android security updates, but only the manufacturer can provide vendor security patches even when a custom OS is installed. If Xiaomi did this monthly, its phones would be as hacker-friendly as Google's Pixel phones.
This could have been a race between Xiaomi and Huawai but trump decided against that.
I wonder if xiaomi will do that as well.
If Xiaomi went ahead and locked bootloaders on their own will (instead of gov't requiring it), they would be crushing the same thing that allowed them to become successful.
When i bought my Redmi 4a, as a backup phone, i had to root it and flash with lineageos, because the amount of telemetry that phone was sending somewhere was straight up absurd. Same story with Mi 8.