OS updates are security issue. Users cannot really apply updates to devices so manufacturers should be required by law to support and update devices for as long as the device exists.
Sure the manufacturer would really be better off selling you a new one. If they issued no updates you would have to buy a new device every month or three.
Look at car recalls, the same standard should be set for support of devices. If there is a system issue and a security update is needed the manufacture should be required to provide it no matter how old the device is. Shame on them for not making is safe/secure in the first place.
Also to avoid false fronts there should be a mandatory bond for 5 years of support should the "manufacturer" disappear. The bond price will be very low for real manufacturers.