> Maybe make it a law that company needs to maintain certain level device security via software update for N years for internet connected devices.

Just expand the warranty laws – security updates are fixing a manufacturing defect that makes the device unusable.