People already have been brainwashed on "how many years of security updates does this smartphone model have?", and being paranoid about older-than-a-few-years devices, so you're not far off.
(Not trying to diminish the necessity of software security updates, but at the same time I could not find any Android exploits that do not involve users installing malicious apps, supply chain attacks, or state actors)
Someone I know got screwed over when 3G shut down. Their business used an alarm system with a 3G modem (using a cheap data-only SIM card).
The "updated" version requires subscriptions, an app, and goes through manufacturer's servers, so more expensive, and several more points of failure.