The original Android One program, the program that was supposed to bring Android to the next billion users, was something quite different than today's Android One.
Three years of security updates count from release so I imagine two years of OS upgrades also count from release. And since they formulate it in terms of time rather than the number of major OS versions, I don't think we can make the leap and take two years as two versions. Although, I believe HMD actually promised versions/ number of upgrades, not years. After all, these are minimums to qualify, it's not set. But I don't think they ever made any promise as to how fast will those upgrades arrive. Who knows, Google might be just leaving the option of not releasing a major version every year on the table. The faster argument should really be compared to the phone not being part of Android One. Pushing a major OS upgrade still requires work from the manufacturer and if they have 10 models to upgrade, they won't do them all at once. The nature of the program just makes it less work and therefore faster.
The problem with taking it as "whatever we happen to release within the two years" is that it's an empty promise. Unless there is a deadline that would force them to release a version, they could simply choose to release nothing and wouldn't break the promise. "We have given you access to upgrades for two years, we just never chose to release any."
You'd have to look, I read a bit detailed article about the program (its requirements) perhaps a couple years ago and I believe there might be some deadlines involved. Or it might have been the Enterprise Recommended. I recall it very vaguely. It would certainly make perfect sense. And it's a question how strict is Google about adherence and what they can do. I have certainly heard of phones breaching promises of Google's programs.