Apple does have a very good reputation for building reliable products (with a few notable ~~keyboards~~ exceptions) and providing security updates - but I think that there's an argument to be made that that should be an expectation of phones in general, and not limited to Apple.

If one wants a slightly lighter-touch regulation strategy, instead of directly mandating that "a phone must have security updates for n years", legislation could require that (a) CO2 emission cost used to manufacture (b) MTBF (c) warranty period and (d) guaranteed security+OS update lifetime be included on the packaging (like nutrition labels). Then, when shopping, consumers can see that the $700 phone has a 5 year MTBF (and is repairable) while the $400 phone has a 2 year MTBF - similar to the unit prices that are already included on grocery store price tags.

Back in 2017 I found my old iPhone 3GS in a drawer. It booted up fine and held a charge for a couple of hours. Amazingly it even connected to the App Store and could still download apps I'd bought 8 years previously.

I gave it to my daughter who just started secondary school here in the UK. She had to have it switched off at school, and switched it on when she left so a few hours of charge was fine until she got home. I got her a new phone that Christmas, but for a few months she got good use out of it.

My mother just recently updated from the 5s, simply because she dropped it. She used it daily for phone calls, texts, and looking at photos of grandkids. She switched to the iPhone 6.

The 5s really was a great phone. I used it up until last year and only upgraded as my wife needed a new phone and there was a BOGO deal.