Security updates and finite battery lives seem to have a convenient crossover. I'm fairly sure if we could keep a device alive indefinitely, people would use them much longer.

I don't think you can safely have replaceable batteries without first making sure the devices' software are user serviceable. Completely flip the development model to something much more like a Linux distribution and get the onus on updating away from the people plugging bits of electronic-Lego together.