I mean, yes, but it wasn’t that long ago that Google had to get everyone to agree to at least 18 months. And the market would correct for that, but everyone was doing the same thing - abandoning a device mere months after its release.
And from the manufacturers side it’s not hard to understand why the finance dept doesn’t want you to spend more money on a product that’s already been purchased.
Given that many new phones were bundled with two-year contracts it seems likely that consumer protection laws in many places would have meant a phone that was not properly supported for at least that long after the time of purchase would have fallen foul of fitness-for-purpose rules and potentially entitled customers to partial refunds or updated replacements.
And from the manufacturers side it’s not hard to understand why the finance dept doesn’t want you to spend more money on a product that’s already been purchased.
Sure but again that's why we need consumer protection rules. Any security patch implies that the original product was defective. Buyers are entitled to reasonable corrective action if a defective product was sold to them. It may be unrealistic to release a product with no defects, and the corrective actions are typically intended to compensate for actual loss of value rather than being punitive, but the basic rules still apply.
Four whole years?
It should be outrageous that we might consider such a short period acceptable for devices as expensive and otherwise long-lasting as a high-end Samsung phone. That it is not really surprising at all is a sad reflection on how normalised shipping insecure connected devices with inadequate support has become.
Obviously we don't yet know how to build 100% secure devices of this complexity but we are talking about some of the biggest businesses in the world here. There is little excuse not to require (by law if necessary) essential security updates for a much longer period given the reasonable useful life of the hardware and the rest of the software on it.