I've just had the unpleasant surprise that, even when you do flash your 3 year old flagship phone to get at least some semblance of security updates, Google is

I've just had the unpleasant surprise that, even when you do flash your 3 year old flagship phone to get at least some semblance of security updates, Google is now rolling out hardware attestation for SafetyNet, which is likely to be impossible for anything but the stock Android to satisfy, and means, among other things, that contactless payments are suddenly unusable. So I now, in an attempt to continue using a perfectly functioning device for more than three years, have the rather ridiculous choice between using my phone without security updates, which banks and various apps will consider safe, or using my phone with security updates, which banks and various apps will consider unsafe. Yet how long will it be until manufacturers simply start disabling devices more than a few years old altogether, or crippling them, in the name of security?