For consumer devices the solution could be the consumer protection legislation. For example in EU the manufacturers/sellers are responsible for the devices afte

For consumer devices the solution could be the consumer protection legislation. For example in EU the manufacturers/sellers are responsible for the devices after the sale. The exact time is not defined, but I believe for average consumer electronics 2 years is kind of minimum. During that period the manufacturer is responsible for defects in the products. The responsibility means they need to fix them, provide new (working) gadget or provide financial compensation. If we would defined that device with a known security vulnerability is broken, the manufacturers/resellers would need to take action. Suddenly there would be direct financial consequences for shipping broken devices for which updates don't exist. I'm sure this would quite quickly lead to manufacturers putting more effort on providing updates and maybe even to proactively preventing security issues.