I think there are some pretty clear-cut cases where it's easy to argue that a phone isn't up to date. For example: a critical severity vuln in the Linux kernel

I think there are some pretty clear-cut cases where it's easy to argue that a phone isn't up to date. For example: a critical severity vuln in the Linux kernel that's already been patched upstream >6m ago, but that phones don't have yet. If this legislation starts to get the SOC manufacturers and device manufacturers to play ball, I think it could be a huge win.