A sane architecture means support is much easier. I've used low power PCs that were more than one decade old, and I could still run the same well supported software as in a newly built machine.
Some regulation is needed to stop this madness. We don't have enough resources to let everyone trash their phones every three years. Rare earths are scarce, not to talk about all the junk going to landfills.
Had IBM been able to prevent it (and they did try with PS/2 and MCA when the courts failed), there wouldn't be PCs as we know it, rather like every other 16 bit computer of the time.
For example if a CPU instruction-level issue was discovered Fairphone would have no way to fix that without microcode updates. This means that a vendor can't guarantee security updates for longer than Qualcomm will offer low-level support. However the discovery of an explotable instruction 3 years after release is quite unlikely and as far as I am aware hasn't occured so presumably Google *could" continue updates in this case.
Of course there is still consumer expection issues. If phones are usually supported for 5 years even though they only promise 3 you might feel cheated if your particular model has to stop at 3.5 years.
There is also the option of ignoring the CPU vulnerability but continuing other security updates. However trying to explain this to users is incredibly difficult. Even if you can get their attention you have to explain the impact of being able to break out of the app sandbox to them.
I decided to take a risk with them and buy FP4 to support them.