Well, maybe be more lenient on trailing versions if, and only if there are timely security updates?

I'm not sure the alternative is much better - lots of unpatched insecure phones in use?