True, and that would mostly likely fulfill their obligation, though personally I don't think I should have to accept what is essentially a new product to get a manufacturing flaw repaired.
Also Android/Chrome is free, so just because phones are paid doesn't mean such laws would apply.
Ah, with that I wholly disagree, and I expect the law to do as well. Android (and Chrome nowadays) is clearly part of the package that I buy with the phone, and advertised as such. That the phone OEM got it for free from Google is irrelevant to me as the consumer; I paid for the whole thing.
Chrome is free and also optional. If you don't like the new features that come with the security updates, you can easily use a different browser.
I disagree with the EU's decision to force MS to have that browser selection dialog, but that doesn't mean bundling should be consider a "gift" by the manufacturer. A browser is an expected part of a current smartphone OS, and as such they should be responsible for the one they include.
Also Android/Chrome is free, so just because phones are paid doesn't mean such laws would apply.
Phone security updates are sometimes provided for some time, actually. I know Samsung at least went back and made new releases for abandoned phones after stagefright.