Given that many new phones were bundled with two-year contracts it seems likely that consumer protection laws in many places would have meant a phone that was not properly supported for at least that long after the time of purchase would have fallen foul of fitness-for-purpose rules and potentially entitled customers to partial refunds or updated replacements.

And from the manufacturers side it’s not hard to understand why the finance dept doesn’t want you to spend more money on a product that’s already been purchased.

Sure but again that's why we need consumer protection rules. Any security patch implies that the original product was defective. Buyers are entitled to reasonable corrective action if a defective product was sold to them. It may be unrealistic to release a product with no defects, and the corrective actions are typically intended to compensate for actual loss of value rather than being punitive, but the basic rules still apply.