There is an EU law that mandates selling supplies (e.g. vaccum cleaner bags) a certain number of years after the device is released. I would argue that "security updates" should be treated like "supplies".