If you could demonstrate harm from a vulnerability, you could probably ask a court for some compensation.

Just like if your lawnmower exploded with a known flaw, you would sue the lawnmower manufacturer.

Qualcomm's lack of support for older chipsets has been blamed for the short lifecycles of these phones. Pixel 6 and 7, which don't use Qualcomm SoCs, both get at least 5 years of security updates.

Google is ten times the size of Qualcomm— there's no way they wouldn't be able to extract those commitments upfront.

Google is, but most of Google isn't (wasn't) purchasing SoCs from Qualcomm. Its hardware division is tiny.

I still remember when phones did not receive any updates, and the few lucky models required developer tools to manually upload the firmware updates, which most of those few selected models only got one in their lifetime.

Not sure if you’re referring here to the BlackBerry era or right back to side-sliders and razr flips, but either way, both the stakes and the attack surface were way lower back when there were no apps and phones really were just for calling and texting.

Brew, Symbian, Java ME and Windows CE/ Pocket PC, Palm era.

Plenty of apps and networking in Europe and Asia.

Fair, okay— as soon as email, payments, or banking is involved then you have a juicy target and you need a device that's secure end-to-end.