Mobile security is a huge mess because of planned obsolescence. There should exist no security reasons that force me to junk a device faster than 10 years if the manufacturer is still in business.
Regulatory action is required, that should think past the traditional "warranty" periods, removing security support is a remote confiscation of private property.