That actually sounds pretty fair, with the proviso that I would say 4 years after the sale of the phone, rather than that phone model.
But given that we are talking about Androids here, why should they be required to release full source? Shouldn't it be enough that they release driver code?
If they unlock it, and release full sources so you can access all the hardware in alternative builds, then fine, they can drop support when they please.
It isn't an either/or, in my world they could keep it locked for 3 or 4 years, providing full updates, then provide unlock and a year later drop security updates.
My point is, security updates need to come before profit, and no one should be selling phones a year before updates end. Or even, not even do updates!