First, you'll be better off using a more sensitive measure than ROC-AUC to compare model types. See this page, for example. Harrell notes there (and elsewhere) that AUC (equivalent to the C-index and directly related to Somers' $D_{xy}$) is OK for describing a single model but isn't sensitive enough to distinguish quality between models. I appreciate (and have used) the ways to incorporate censored survival data into ROC curves that Heagerty and colleagues have developed, but those won't be any more useful for comparing between models.
It's most helpful to examine and compare detailed validation and calibration of the models. The R rms package provides general functions that can be applied to a wide variety of models including binomial/logistic and Cox proportional-hazards regressions at a specified survival time. These functions use resampling to estimate optimism in the fit and the quality of predictions both overall (validate()) and as a function of predicted values (calibrate()).
The resampling used by both validate() and calibrate() helps to evaluate model overfitting and thus how well the models might be expected to perform on new data samples. So if you want to use the $D_{xy}$/C-index to compare the models, at least use the optimism-corrected values returned by validate(). Other reported measures that could be more sensitive to differences between models are those related to the overall calibration in terms of expected versus observed probabilities (discrimination index, unreliability index, and their combination in an overall quality index).
The most sensitive comparison would tend to be the calibration curves provided by the calibrate() function, as they give not only overall estimates of reliability but also displays of model performance over the range of outcomes. Depending on how you intend to use the models, particular regions of those curves might be more important than an overall estimate of reliability.
Second, you have a potentially big problem with your binomial model that might not show up in comparison against the Cox model. You coded those who were still alive but followed up for less than 2 years the same as those who survived a full 2 years. So you're not really modeling 2-year survival; it's whether there was either 2-year survival or any survival less than 2 years without evidence of death. What if some of your predictors are associated specifically with those surviving at less than 2 years' follow-up? Then your model might predict well that combined class of survivors and look very good on your data as coded, but the model wouldn't properly be predicting 2-year survival. So a high AUC in that circumstance might be technically correct but clinically meaningless.
For binomial/logistic regressions, it's better to treat cases without complete follow up as having missing outcomes, and use multiple imputation to fill in the outcomes. Stef van Buuren's book goes through the rationale, including imputation of outcomes. If data are "missing at random" (as distinguished from "missing completely at random") in the following technical sense, multiple imputation is a well respected and valid approach:
If the probability of being missing is the same only within groups defined by the observed data, then the data are missing at random (MAR).
Note that MAR could describe a situation in which your predictors are associated specifically with those surviving at less than 2 years' follow-up. So multiple imputation could overcome that problem with your data, while providing a valid model of 2-year survival.
