First, you'll be better off using a more sensitive measure than ROC-AUC to compare model types. See [this page](https://stats.stackexchange.com/q/17480/28500), for example. Harrell notes there (and elsewhere) that AUC (equivalent to the C-index and directly related to Somers' $D_{xy}$) is OK for describing a single model but isn't sensitive enough to distinguish quality between models. I appreciate (and have used) the ways to incorporate censored survival data into ROC curves that Heagerty and colleagues have developed, but those won't be any more useful for comparing between models.

It's most helpful to examine and compare detailed validation and calibration of the models. The R `rms` package provides general functions for that (called `validate()` and `calibrate()`) that can be applied to a wide variety of models including binomial/logistic and Cox proportional-hazards regressions at a specified survival time.

Second, you have a potentially big problem with your binomial model that might not show up in comparison against the Cox model. You coded those who were still alive but followed up for less than 2 years the same as those who survived a full 2 years. So you're not really modeling 2-year survival; it's whether there was either 2-year survival *or* any survival less than 2 years without evidence of death. What if some of your predictors are associated specifically with those surviving at less than 2 years' follow-up? Then your model might predict well that combined class of survivors and look very good on your data as coded, but the model wouldn't properly be predicting 2-year survival. So a high AUC in that circumstance might be technically correct but clinically meaningless.

For binomial/logistic regressions, it's better to treat cases without complete follow up as having missing outcomes, and use multiple imputation to fill in the outcomes. Stef van Buuren's [book](https://stefvanbuuren.name/fimd/) goes through the rationale, including imputation of outcomes. If data are "missing at random" (as distinguished from "missing completely at random") in the following technical sense, multiple imputation is a well respected and valid approach:

> If the probability of being missing is the same only within groups defined by the observed data, then the data are missing at random (MAR).

Note that MAR could describe a situation in which your predictors are associated specifically with those surviving at less than 2 years' follow-up. So multiple imputation could overcome that problem with your data, while providing a valid model of 2-year survival.