Some other examples of non security issues that might require modifications:

* Widespread adoption hosting multiple services on the same IP, relying on SNI for TLS to function. While this is in TLS as well, it's not a security issue. In practice it was adopted slowly enough that it didn't cause many problems

* A quick switch from IPv4 to IPv6 (lol)

* Y2K (happened before smartphones)

* timezone database changes (e.g. if the EU abolishes DST)

* Regulatory changes (e.g. which frequencies the phone may send on)

* A third party service the phone relies on for essential functionality gets shut down

Wikipedia indeed no longer supports TLS 1.1, i.e. if the phone didn't receive any updates beyond security updates, it'd be broken.

This seems to have happened around 2019: https://phabricator.wikimedia.org/T238038

I'm honestly surprised, I expected the overlap between "everything new supports this" and "actually turned off" to be bigger.

So realistically, after 5 years without updates, the phone would be a brick. That's still 3 more useful years for people who care about security, and perhaps more importantly, 3 years where people who don't know about the importance of security updates or can't afford to care remain secure. This also assumes no non-security updates at all.

Well, to be fair here, the phone would still be able to make phone calls and send/receive texts, so it would hardly be a brick.

As a practical matter, stuff like supporting a newer version of TLS is at the application, not the OS level, so the user would just have to get an update with their browser to be able to use newer TLS. [1] Supporting newer TLS, for a browser, is little more than recompiling the browser; even stuff like Lynx and newer builds of Dillo have current TLS support.

[1] Windows XP stopped being updated by Microsoft in 2014 [2] but Firefox up until 52.9.0 (2018) runs in Windows XP.

[2] The post-2014 point of sale updates were quite limited in scope, and can not be seen as general OS updates

For the average user who doesn’t know about security, having their phone updated w.r.t. security but having the phone’s built in browser break because it doesn’t work with modern TLS websites would be much better than having them have their phone compromised and critical information given to hackers. They would be able to get a new phone (or download another browser) if they want a modern browser with modern TLS; that’s a very different rodeo than the current situation of “update your phone or have security problems” with phones not even five years old.

On the other hand, nearly every application use the base OS TLS libs and cannot connect anymore to servers that disabled TLS 1.0/1.1 on Android 4.4.

To engineer the app work remotely safely on such vendor-abandoned devices you need to basically assume you're running on a malware or rootkit compromised device, and just hope that by using your self bundled components you'll have better chances to survive in the core wars game because your app is not being specifically targeted.

A vulnerability in TLS1.2 would need to be fixed (by implementing TLS1.3) in 7 years under "security patching".

Today, you can often find such new phones on sale, yet already? No security updates. End of support.

So the life of a phone model before you even buy it new, may be years...